You can use Stolen Device Protection to protect against the rare instance when someone has stolen your iPhone and knows your passcode. Stolen Device Protection prevents the person from performing critical device and Apple Account operations (like changing your device passcode or Apple Account password). It does this by requiring biometric authentication with Face ID or Touch ID. There is no passcode to fall back on.
When Stolen Device Protection is turned on, more sensitive operations require a Security Delay: a successful Face ID or Touch ID, an hour wait, then an additional successful biometric authentication. Security Delay helps prevent someone from making changes to settings that can lock you out of your iPhone or Apple Account. These measures help protect your device and account, and give you more time to Locate a device in Find My on iPhone