The goal seems to be breaking the real-time guidance scammers rely on.
24h probably works, but it feels like a heavy tradeoff for legit users.
Now, phone thieves just ask you at knifepoint or gunpoint to log out of iCloud
(I'm being a bit overly cynical there but IMO only the tiniest bit.)