That would be the fact that Apple lets anybody that knows the passcode reset the iCloud password as well, without any further authentication

Doesn't this require at least one other device to allow access and provide a one-time code?

I can't log in to iCloud in a browser, update payment information, or do anything even remotely sensitive with just one device and my screen lock mechanism(s).

EDIT: I stand corrected. On a device that's designated as "trusted" you can indeed change the password using only the screen unlock using the instructions at https://support.apple.com/en-us/102656