Maybe requiring approval from the iOS account that manages the device, signed in to some other device? I'm imagining something somewhat similar to the "ask to buy" feature for child accounts. That could also help with child or elder accounts if they're managed by someone else holding the keys. Downside is not everyone would have someone to manage their account for them.

Having to call into Apple to confirm maybe?