That means that they've lost both the iCloud (Apple ID) account AND the device password...
Well, at some point, they device might as well be bricked.
Otherwise device theft would be much higher (since they could use it, whereas now they can't), plus of course if lost/stolen people would have access to the data.