Very true, many of the actions taken mention whether the processing is being handled in the cloud or locally.
While I’m not going to claim to be an expert on the matter, it’s my impression that authentication & verification are limited primarily to downloading/updating software— once you’ve managed to bypass the activation and keep mind to avoid updating directly through the app, you’re “inside the walled garden”.
As you’ll see from the HT article, you need a court order and possibly to present a death certificate if you want to gain complete access to the account.
If you have access to their phone number, and the account had 2FA, you can use that trusted phone number as a point of access into the account, otherwise the court order is the only way.