Spying Through iCloud

If someone unlawfully obtains access to your iCloud login information, it seems to me they can activate an entirely separate iOS device with your iCloud account, which means they can view your Safari history, Notes, and virtually anything else that's a part of your iCloud account.

If you change your iCloud password, perhaps because you suspect that someone may be monitoring your activity using the above method, does this log the criminal out of your iCloud account on his device? Or does his device go on syncing with yours anyway? I've never had to "login" to iCloud on my device, so I'm not sure whether changing the iCloud password causes a prompt to appear on all devices using the account to enter the new password before syncing continues? If not, it's clear changing your password doesn't resolve the problem. Would activating two-step authentication cause a prompt to appear on all devices?

I'd appreciate any insights from experienced users. Thanks.