A computer science graduate student at the University of Waterloo nearly wiped his iPhone and Mac. Attacker used Apple’s lack of two-step verification for the Find My Phone feature. Attack could have been prevented as well if there was a second factor of authentication for Lost Mode, as the 2FA that everyone suggested to turn on doesnt protect Find My iPhone as seen here. The student is still happy with Apples security features, but he does feel Apply should look into those shortcomings sooner rather than later.”]
Source: https://grahamcluley.com/apples-lack-2sv-phone-nearly-costs-student-digital-life/