I can’t believe they didn’t have some kind of lockout policy. Even a ten-try maximum would be effective against brute-force; you could also establish a modest lockout duration so legitimate users could try again after a set amount of time.
Apple has a “ten try” option for our phones to force erasure in the wrong hands, if my memory is correct. But it is optional per phone and does not begin to cover security on APIs and other environmets like iCloud.
These ladies will be dealing with the fallout the rest of their lives. The pics were meant for a specific person. As iPhones default to uploading to the free 5 GB drive space (encouraging us to purchase more to cover our growning data), these women probably didn’t think there was even a concern.
Apple is looking really bad, now. We will still buy the new iPhone 6s, but we will also continue to keep iCloud off.