Something every iPhone user should do to mitigate this to an extent: go to Screen Time settings and
-
Set Screen Time Passcode
-
Go to Content & Privacy Restrictions > Disallow changes to Passcode and Account
With this the thief will need to know your Screen Time passcode as well to make any changes to your Apple ID.