To change your iCloud passcode: https://support.apple.com/en-us/HT201355
To change your phone passcode: https://support.apple.com/guide/iphone/set-a-passcode-iph14a...
To change your phone passcode: https://support.apple.com/guide/iphone/set-a-passcode-iph14a...
That's only the Apple ID/iCloud/account password, which plays only a minor role in end-to-end encryption.
The phone passcode is the (secret which gates, on Apple's HSMs,) your iCloud encryption key!
https://support.apple.com/guide/security/escrow-security-for...
Got "1234" as a passcode on a long-forgotten family iPad or test iPhone? Better go change it to something secure, as that's what stands between an advanced attacker (that can compromise your 2FA), or somebody able to compromise/apply sufficient pressure to Apple, getting into your iCloud end-to-end encrypted data.
https://support.apple.com/guide/security/secure-icloud-keych... (describes how both approaches work)
https://support.apple.com/en-us/HT204915 (documents that two-factor authentication is now effectively mandatory, which makes using recovery keys impossible)
The device PIN is now exclusively used (off-device!) for iCloud end-to-end encryption key recovery: https://support.apple.com/guide/security/escrow-security-for...
Are you sure it's either/or? Have you gone through the process, and are you sure the PIN is required off-device, rather than ? If that's the case, I do agree that it's not good.
Also I don't quite understand the threat model where a stronger authentication to iCloud allows for weaker data encryption. Considering Apple is usually pretty spot on with these things, this would definitely stick out.
according to the article, I don't think this will be possible because you won't even be able to turn on Advanced Data Protection in this scenario.
"You must also update all your Apple devices to a software version that supports this feature."
Just to get the feature enabled you're going to have to go and "touch" all of the devices you're signed into and either update their OS (and also update their passcode if you're smart) or sign out of them.