Yup, I'm guessing that's it:

https://support.apple.com/en-us/102656

This article seems to make it pretty clear that having a passcode on a signed-in device is enough to reset the password.

That seems like an insane security hole really.

One of the big distinctions I make in my life is whether a passcode is being typed in frequently and in view of the public. And since these are shorter codes, the entity on guessing from a distance is much lower.