Apple makes you wait when they aren't confident in your identity. This is true when logging into your Apple account (or iCloud), or if Stolen Device Protection is activated on your iPhone. I am guessing that neither two-factor authentication nor security questions were set up for the OP’s account (or questions were not answered correctly), and that is the reason for the delay.
Apple iPhones and iPads don’t require multi-factor authentication locally on the phone unless Stolen Device Protection is enabled, or the device is Activation Locked. You may think this is “dumb,” but it materially protects the devices against theft by essentially rendering them useless to a thief, and Stolen Device Protection also protects your Apple account if your device is stolen. You have the option of not using an AppleID on the phone, and therefore not enabling Activation Lock, but that will also preclude you from downloading apps from the App Store. Of course, if it was easy to reset a lost password without much additional verification, the Activation Lock feature would be useless.
I also have a Windows 11 system and a paid Microsoft365 account. The security provided by Apple’s ecosystem is notably better in a number of ways. For example, I can create and remove app-specific passwords without deleting all of them, I can choose to have end-to-end encryption for almost everything in iCloud, and my devices (including Macs) can be activation locked to deter theft.
I recommend using a system-agnostic password manager like 1Password, Dashlane, Bitwarden, etc. If you want your passwords to be hacked repeatedly, LastPass is a good option. All of them can sync across multiple devices, are cross-platform, and integrate with major web browsers.
The bottom line is you can have more security and less convenience, or more convenience and less security. With reputations on the line, there is an incentive for companies to increasingly lean toward a higher level of security.
Currently we sit here, unable to review debrief HUD tapes because the peripherals (DTC USB readers) are blacklisted by the nonners on the non-flying side of base. Winning. Heck, one of my subordinates spent 25 minutes trying to get them to open up the port to the printer. A printer... So we hear ya.
