I think they were doing something like going to settings -> Apple ID try to change the password incorrectly many times (or something like that). That would basically lock you out of your own iCloud account (at least for a while) so you couldn’t lock or track it via find my.

I recommend using the “Screen Time” feature on iPhones to protect against this. You can basically set a _different_ 4 digit pin to access some of the settings of the iPhone, including the Apple ID one. (The setting becomes grayed out and inaccessible until you disable screen time).