[crazygringo]

Yup, I'm guessing that's it:

https://support.apple.com/en-us/102656

This article seems to make it pretty clear that having a passcode on a signed-in device is enough to reset the password.

[XorNot]

That seems like an insane security hole really.

One of the big distinctions I make in my life is whether a passcode is being typed in frequently and in view of the public. And since these are shorter codes, the entity on guessing from a distance is much lower.

[crote]

The even more insane security hole is allowing someone with physical access and the password to permanently lock out all recovery options.