http://www.neowin.net/news/apples-icloud-security-feature-in-osx-is-bypassed-in-just-70-lines-of-code

ouch

So it's not actually 'iCloud security', it's the 'find my device' authentication layer. And even if you unlock that, you still have the 'normal' security layer to get through e.g. a password of indeterminate length and complexity.

So not overstating the case much at all then.

Once unlocked, the Mac could then be started in recovery mode and passwords reset or data copied from the drive.

This is about unlocking the local Mac.

A better method would be to lock the Mac for hours after half a dozen failed attempts or bricking it (requiring it to be taken to an Apple store or reseller). The problem is, that it locks for a maximum of five minutes and it forgets the 5 minutes if you reboot the system.

That is the problem here. If it could remember the 5 minute lockout and/or change that to hours instead of minutes, it would be much more effective, as would having a sensible length password or longer PIN, instead of just 4 digits. As the article said, if the code took into account the most used PINs first, it would probably be able to crack the PIN code a lot faster.

If you have stolen the Mac, you either want to get at the data on the device or you want to erase it and reinstall it so that you can use it yourself or sell it on. You probably don't care about the iCloud account itself.

If that''s what you're bothered about, what you actually need is this. The fact is even without this hack the 'find my mac' lock can be defeated by booting the Mac off a DVD or as you say the recovery partition if you're not actually bothered about keeping the data on it. The 'find my mac' pass lock is about the situation where the person who found it would return it to the origin owner but it gives the owner some piece of mind that it hasn't been accessed in the meantime.

Regardless of all that, the headline is misleading. This is not 'iCloud security' in a real way at all. Cracking the find my mac does not given the person doing so access to the user's iCloud account.