I have just tested this again (first time since May) and in iOS 17, with the 28 digit Recovery key set, I am finding it impossible to change Apple ID account password if a Screen Time Passcode is set.
This was not true in May (even though I had Recovery key set at that time). In May, attempting to turn off or change Screen Time passcode, and clicking forgot passcode or forgot password, eventually led to requiring the phone passcode which the thief already has.
Now the same sequence leads to this screen:
The thief would not have the 28 digit Recovery Key.
I don’t know if this is an iOS17 change or Apple has changed something behind the scenes.