There is one very easy thing you can do to break the first step of the attack
- enable Screen Time
- set a Screen Time password, make it different than the iPhone password
- use Screen Time to disable making changes to your account
With this the attacker would not be able to go to the step of changing the account password without entering the different Screen Time password.
I wonder why this is not mentioned or recommended, seems kind of obvious. Sure it is a bit inconvenient but you probably very rarely make changes to your account.
- enable Screen Time
- set a Screen Time password, make it different than the iPhone password
- use Screen Time to disable making changes to your account
With this the attacker would not be able to go to the step of changing the account password without entering the different Screen Time password.
I wonder why this is not mentioned or recommended, seems kind of obvious. Sure it is a bit inconvenient but you probably very rarely make changes to your account.