Implications of changed security for Apple ID? Recently, Apple logged me out of my Apple ID and made me go through a new procedure where I used my recovery key, and was asked to provide my machine login info, and my iPhone unlock code to be able to access my account. (I was also told that recovery keys were no longer usable, unless I changed setting to enable them, though it's not clear how.)
Is this part of a new Apple security policy? Does Apple now have my machine login info; my iPhone unlock code?
This isn't new. While I can't speak to the exact moment this was added, you can rest assured knowing that your passcode/password is safe. What Apple is doing here is verifying your identity by taking advantage of the fact that you use iCloud Keychain. iCloud Keychain escrow is a fairly complicated procedure, but in essence Apple never sees your passcode, it can only see that their hardware modules granted you access to your escrowed bag which proves that you know the passcode to your devices. It's a really neat solution for account verification!
For more info, see page 86 of the Apple platform security whitepaper.