Screen Time Passcode
As has been mentioned here and a few other places, an additional layer of 'passcode' can be added to iPhone in the form of the Screen Time Passcode. Enable Screen Time, set a 4 digt passcode, and set restriction to prevent Account Changes and Passcode Changes.
With this enabled, someone would need to additionally enter this 4 digit passcode to change your iCloud password, even if they have your iPhone and iPhone passcode.
Yes, it is only 4 digits, but it is enforced by the secure enclave, with increasing timeouts for wrong entry. I like to leave it with intentionally entering the wrong passcode, thus triggering the first timeout of 1 minute before retrying (after 6 failed attempts). Each successive incorrect entry with increase the timeout, but of course, at any time you can enter the correct Screen Time passcode to make the restricted changes.
I wish we could enter longer passcodes for Screen Time, but 4-digits it is for now, and may buy you enough time to reset your iCloud Password and remove the device from another trusted device, before the thieves completely lock you out.
Hope this helps.
