Saegzz wrote:
My understanding is that it would prevent a would be thief from accessing phone and making unwanted purchases
That is not its purpose. Until now, Apple has assumed that anyone who has your iPhone in hand and knows your iPhone’s passcode is a “trusted user” and can also access your Apple ID and change its password. So a thief who knows your passcode (from “shoulder surfing” when you entered it, for example) and has your phone can access your iCloud content, lock your Apple ID account, set a recovery code, and essentially lock you out of all your devices, current and future, forever, or hold them for ransom. And yes, this happens more frequently than people realize.
This change adds a “trust, but verify” capability, that essentially blocks this vulnerability. There are other ways to block it also, but this is a much easier and more secure way. Here’s a user tip with a longer discussion→Secure your iPhone against passcode hijac… - Apple Community