Hackers are using Apple’s “Find My” service to remotely hold devices for ransom

If you directly access the "Find My" service in iCloud.com even if you have 2FA enabled and you even deny the access from another device where you are signed in, it just asks you to change you password but the session remain active...