I recently noticed that when trying to log into my icloud on either my iphone 7 running ios 12.3.1, or my mac running high sierra, i am required to enter my iphone screen unlock password on ios (for icloud login), and my mac screen unlock login for icloud login on mac os. Since when does apple require you to enter your real passwords for hardware devices just to log into icloud? Seems like a security issue.
This is likely due to iCloud's end-to-end encryption. According to Apple's iCloud security overview:
End-to-end encryption provides the highest level of data security. Your data is protected with a key derived from information unique to your device, combined with your device passcode, which only you know.
To access your data on a new device, you might have to enter the passcode for an existing or former device.