https://news.ycombinator.com/item?id=33756458
That behavior seems to have changed now. Apple now seems to require email address to be verified before the iCloud account can be used:
https://imgur.com/a/ZVBf1ZZ
I don't know when this change rolled out though.