Hackers, thieves, and independent repair companies can find ways to break into iCloud-locked iPhones.
The iCloud security feature has likely cut down on the number of iPhones that have been stolen, but enterprising criminals have found ways to remove iCloud in order to resell devices…Making matters more complicated is the fact that not all iCloud-locked phones are stolen devices—some of them are phones that are returned to telecom companies as part of phone upgrade and insurance programs.
TL;DR: Phishing, mugging, and social engineering are methods. You can even remove the CPU and reprogram it by stealing an unused IMEI.
Check It Out: How to Break Into an iCloud-Locked iPhone