Hi. I never though of this but last week i forgot my icloud password while i was signed to my iphone as trusted device. So i went to password change and it simply allowed me to add NEW password and confirm it. Now my phone is new (iphone x) and before that i was using android for a while so i have forgotten how things work, but shouldn't changing the password require typing the old one first? It didn't in my case. That made me think, i always though that if someone find my phone and somehow knows my passcode, he wont be able to erase the device because icloud password wont allow him to. But now if he simply goes to settings and changes the password, he will be able to do everything after that. I am missing something here?