Stolen iPhone - Thieves demanded passcode and turned off Find My. What are best options/advice?

My friend's iPhone was stolen last night. He was held at gunpoint and the thieves demanded his iPhone Passcode. The thieves proceeded to change his passcode, add their Face ID, and change his Apple ID password, all in front of him. Find My was disabled. He's now locked out of accessing his iCloud, leaving thieves with access to all of his passwords in keychain, apps, etc.

He has reached out to Apple and started the Apple ID Recovery process, but must wait at least 21 more hours until the next update. I am wondering if anyone has any advice/best practices for such a situation. What would you suggest he do? Is there anything to do other than sit and wait?

On a side note, I must say, I think it is shocking that Apple allows someone to change an Apple ID password without requiring the old Apple ID password. Thieves can go into Settings and type the iPhone passcode, which then allows them to change the Apple ID password. Shocking security failure, in my opinion. Why wouldn't you also require the Apple ID password to make that change?

Anyways, just looking for best advice you would give to my friend. Any and all advice is appreciated.