First of all, I'm very sorry this happened to you. Thank-you for raising the issue again, as it's clearly something people need to keep in mind.
As others have mentioned, this security flaw is almost certainly by design.
The simple fact is, many many many more people are going to forget their iCloud password than are going to have their phones screenhacked and then stolen. Getting all the iCloud password changes/verifications/recoveries done is bound to be far more time consuming and problematic and lead to more customer complaints for Apple than doing it for the relatively small subset of people whose phones were stolen. In the interest of faster and more reliable customer service, it makes far more sense for Apple to have an easy way to reset the iCloud password when it's forgotten.
I think the first takeaway message here should be to secure devices with as long and complex of a passcode/passphrase as you can reliably remember. Just in case you have to enter it publicly. If someone's looking over your shoulder, there's a limit to how much they can memorize. If it's too complicated to memorize quickly, they'll choose an easier target. And every device should be secured with a unique passcode/passphrase. We're not generally talking about sophisticated criminals here who have hacked into CCTV and are looking at high-res slow-mo closeups where they can see every keystroke you make. In a case like this they're looking for quick and easy.
That said, it seems like there should be a relatively easy way for Apple to address this scenario. For example, giving users an option to secure their iCloud password & account recovery options with a 2nd PIN that (should) not match any device PIN or passcode. Since the only reason to enter this PIN would be when messing with account settings, it shouldn't be as susceptible to screenhacking. For what it's worth, this should fail out after a certain number of tries, and eventually be able to reset using just the device passcode or passphrase. But put it on a 72 hour timer so if the device passcode was compromised, the account owner has time to lock out and erase the device if it was stolen. Another, and probably more secure, way would be to require FaceID or TouchID rather than a 2nd PIN - again with the timeout.
And yes, I'm ignoring the scenario raised in a few posts about violent means being used to extract personal data like passcodes, passphrases, and PINs and even FaceID or TouchID. First, it's an outlying scenario. Second, if someone is threatening or actively perpetrating harm upon you and you have no reasonable means to fight back without risk to yourself, in the vast majority of situations the best thing to do is give them what they want, walk away as intact as possible, and try to put the pieces back together later as best you can.
I'm further ignoring social engineering attacks. Short of requiring multi-factor authentication with a separate physical device for account changes (something most people aren't going to do) there's very little Apple could do to protect people who willingly volunteer private information.
