iPhone Stolen - Recovery Key Generated

I've seen numerous posts on here around losing a Recovery Key here and had a question.

My phone was stolen on October 16. Somehow the thief must have saw me enter my password and within a very short timeframe of the phone being taken they disabled FindMy, changed my icloud username and password and generated a new Recovery Key which I'm finding makes it impossible to get my account back.

I must be missing something here and hoping for an explanation. How in the world is a Recovery Key useful if the thief is able to simply re-generate a new Recovery Key if they confiscate your device? They have your device and presumably (most people are) synching your email to your device. This is a double whammy.

What possible recourse does the victim of the crime have here and how is this even possible? This seems like a fatal flaw. Can anyone explain this to me?

Thanks.

Greg

[Re-Titled by Moderator]