1. Doing the password reset
2. Reboot straight back into recovery
3. Update your new password back into your old password
4. Boot into macOS, your default keychain will unlock but you'll still have to re-authenticate to iCloud since your machine-user identity combo will no longer match with what iCloud expects. (not sure if this is part of Octagon Trust, but there are various interesting layers to this)
There are a number of much more in-depth technical guides and specs, but just listing out random articles (or the Black Hat talk(s)) would probably rob someone of a nice excursion into platform security.
I guess the same also works for cloud accounts as well. I remember, back in the mid-2000s, trying to log into my hotmail account (never having failed to log in before) and getting a "locked out due to too many bad passwords". So someone, only knowing my user account name (which was the same as my email address), locked me out of my own account. The problem was, I couldn't remember what my recovery accounts were (I eventually figured it out).
Got home, pulled out my phone, and it had a message that it was locked for several hours due to so many failed passcode attempts. Incredibly annoying.
Still, only happened once in well over a decade of owning an iPhone.
I was mostly frustrated that there wasn't some alternate way of regaining access, like via my Mac or iPad logged in with the same Apple ID. Or that the failed passcode attempts didn't start eventually playing a loud alert sound or something on each failure.
I've had to turn off a lot of features. All of the "raise to wake", always-on screens, gesture controls, movement controls on the watch, live activities on the watch, all sorts of stuff, anything related to movement or waking up the phone other than by a button press. Also had to turn the watch so the buttons are on the left to stop my gloves pressing them constantly.
It's a bit sad really, I think I've missed out on some decent features there. But compared to being locked out and/or having random actions trigger, it's an improvement.
On my pixel 4a, I had to turn off a "call 911" feature that I think was initiated by shaking the phone. I took a couple of walks with the phone in my front pocket, and the movement from my leg called 911 (which I would only find out when the police would call me back to ask if everything is OK).
It makes sense for 4 digit codes, but I have a 20ish character password, I once locked myself out, and it was an incredibly frustrating experience.
My password can't be brute forced even with offline access to the hash, there is no risk of it being brute forced from keyboard input.
(The login keychain is encrypted using the user's password, so it's reasonable to create a new one when the password is changed - otherwise, you end up in a situation where applications constantly pop up prompts for a password the user doesn't know every time they try to access the keychain, e.g. to load saved passwords in Safari. I've seen this happen on older versions of macOS and it's positively infuriating.)
These days, I believe that the only reason one does not get such misfortunes of being hacked/attacked, is that most of us are not important enough to get the attention of any external threats. Hence, mostly luck more than actually being secure.
I have been working towards a process/pattern, as a last resort, to be able to walk out of anything and have backup options when misfortunes strikes or my luck runs out. I don’t even know the path yet.
What happens if you just set up the device as a new machine and login to your iCloud like normal?
I'd probably opt for a more defensive action here and just rename it (like the original reset did).
Going in to fix a service that uses sqlite and seeing 5 other times I recovered data or was making a change is always fun.
This assumption, by a clearly technical person, is a fundamental problem that keeps "the rest of the world" locked in to centralised services where that is true, and where that master key can be used against them by law enforcement, fascist regimes, and surveillance capitalists.