There are a few things that I wish I could change which would improve my personal security posture massively:

1. When advanced data protection is turned on, it should not be possible to change the Apple ID password without the associated hardware tokens.

2. Again when advanced data protection is on, it should require the hardware tokens to add a Face ID appearance or change the device passcode.