I saw advice here a while back about using Screen Time to block PIN and Account updates. This gives you a separate PIN to protect those, so theoretically if someone shoulder surfs your phone PIN they can’t take over your iCloud account.
I use this trick. It's an added layer of security, although a weak one — Screen Time PIN is four digit-mandatory — and a workaround — as in: not made for security purposes.
