fwiw, the passcode challenge is for decrypting your keychain. If you fail that, you lose your passwords and other E2E data, but for better or for worse, not that much stored stuff is E2E encrypted and so you don't lose too much. I don't know if it's still true, but a few years back if you lost everything (i.e. didn't know your passcodes, didn't have a device to approve the sign in from) you could still get back into your account by waiting two weeks and recreating your keychain. This also means that if you are ever away from the internet for two weeks and someone knows your password that they can jack your shit but that's quite the edge case imo.