iCloud security problem

Apple added the two-step authentication to prevent security breach.

However, I noticed that people can still lock your devices by signing into icloud.com on browser if they know your password by any means.

I activated the two-step authentication for my Apple ID, but it doesn't prevent someone from locking my devices.

Using mail, note, contacts, reminder needs the authentication, but "Find My iPhone" doesn't need it.