I think these theoretical scenarios probably don't apply to Apple? As long as devices are password-gated. If you have a password to someone's device, it's already over, they have access to everything, including synced passwords.
Btw, something that Apple does sync that's similar is passkeys. They're synced to iCloud. At least on GitHub, you don't even need 2fa if you log in via passkey.
Btw, something that Apple does sync that's similar is passkeys. They're synced to iCloud. At least on GitHub, you don't even need 2fa if you log in via passkey.