There are actually a few ways around iCloud lock, they all aren't great for thieves:
1. An insider (hard to get)
2. Phishing the owner (your device has been found, just sign into your Apple ID on this specific login form...)
3. Physically going to an Apple Store, with faked proof of purchase, and ideally a convincing disguise
4. Resell to some Chinese reseller (particularly because China doesn't use the same IMEI blocklist as the rest of the world), and take whatever they give you, and then it's not your problem anymore
Option #3 is surprisingly popular for petty criminals.
1. An insider (hard to get)
2. Phishing the owner (your device has been found, just sign into your Apple ID on this specific login form...)
3. Physically going to an Apple Store, with faked proof of purchase, and ideally a convincing disguise
4. Resell to some Chinese reseller (particularly because China doesn't use the same IMEI blocklist as the rest of the world), and take whatever they give you, and then it's not your problem anymore
Option #3 is surprisingly popular for petty criminals.