Apparently not. All you need is to get the victim to give you the device password and you can then reset the iCloud password and remove the device from the account.
1. Set a "Screen time" passcode (different from your device passcode!)
2. Go into "Content and Privacy Restrictions" and set "Passcode Changes" and "Account Changes" both to "Don't Allow"
Now you will need to go back and enter your screen time passcode every time you try to change the settings of your Apple/iCloud account, which is sort of annoying. But it'll probably save your account if someone does get your phone passcode.