It’s not a good thing to lock out users who are clearly and demonstrably the owners of a device. Automated protections are good, but there should be procedures in place to handle cases like these.
By keeping a copy of the keys, they are also getting the responsibility to use them when the owner needs them because if they don’t, it raises serious concerns as to why they keep the keys in first place.
To me, the risk of something like what happened to OP is more concerning than being able to lock a thief out of using/reselling my laptop. So I'd prefer to just disable Activation Lock entirely, and prevent it from ever being enabled. Of course, the ability to do that essentially reduces the theft deterrent somewhat, so Apple wouldn't want to implement this ability.
If somebody has POSSESSION of the Mac, and either:
1. An Apple ID registered with the Mac
2. A proof of purchase
3. A court ruling establishing them as the owner.
Presume they are the owner.
Regarding state level actors, they are not interested in stealing people’s MacBooks, they are interested in stealing peoples Data. Removing the activation lock from a Mac != exposing the data on it. Regarding common thieves, see above.
If Apple isn’t confident that they can authenticate ownership, they have no business locking out Macs. It is really not as hard to authenticate ownership as you think though in cases where the person claiming ownership has possession of the Mac.