Recovering an iCloud ID to which I have lost access

Your account is lost.

The only gaping hole in security you refer to is the ability of users to tell others what their Password is. There is nothing that is ever going to stop someone from doing that. With Two Factor Authentication, even with the Password, it is not possible for another user to log into your account without a verification code that is sent to your device, unless they were previously allowed to log into your account. Changing the Trusted Phone Numbers is only possible after a person was able to gain access to your account with information that only you should know.

At this point the only chance you had to prove your identity is through the credit card information. The CVV number on the physical Titanium Apple Card cannot be changed and is not the rotating number you refer to with the Virtual Card, unless the card is replaced. The Virtual Card and the Titanium Card have completely different numbers associated with them. There are steps that could have been taken previously to secure your account further by providing a Recovery Key, but even then it would not be helpful if that key was also given to another person.

You should consider your account as lost and create a new account. With the valuable lessons you learned, I suspect you would not allow that to happen again.

Trust me you aren't the first nor will you be the last. However, it can be prevented by not giving anyone your info or access to your device. It's not up to Apple to force people not to give their info to others.

Apple is the "Guru of privacy and security" because they are extremely strict when it comes to data. The reason they are so strict is anyone can call pretending to be you and give enough info to steal your data. So they make it full proof. Only someone with specific data (card details or access to a trusted device you are logged into already) can gain access. Not data you want to give, but data Apple has stored from you previously, almost always is a credit card you used with your Apple ID.

Without that card info you won't be able to regain access. Just remember next time to never give your passwords, passcodes, pin numbers or access to your devices to anyone. And always have a recovery contact so this doesn't happen again. Set up an account recovery contact - Apple Support

With an account recovery contact you could have bypassed everything and regained access quickly.

The Apple Card will work just as any other card.

How to use account recovery when you can’t reset your Apple Account password - Apple Support

In some cases, you might be able to shorten the account recovery process or reset your password immediately by verifying a six-digit code sent to your primary email address. You might also be able to shorten the wait time by providing credit-card details to confirm your identity. If you’re given this option, an authorization request goes to the card issuer.

If you allowed someone access to your account, and they subsequently changed the details, you no longer control the account. You’ll need to provide the requested information to prove ownership.

So, after you provided the information, what did they say? Generally recovery can be faster by providing the card information connected to your Apple Account.