1. Doing the password reset
2. Reboot straight back into recovery
3. Update your new password back into your old password
4. Boot into macOS, your default keychain will unlock but you'll still have to re-authenticate to iCloud since your machine-user identity combo will no longer match with what iCloud expects. (not sure if this is part of Octagon Trust, but there are various interesting layers to this)
There are a number of much more in-depth technical guides and specs, but just listing out random articles (or the Black Hat talk(s)) would probably rob someone of a nice excursion into platform security.
I guess the same also works for cloud accounts as well. I remember, back in the mid-2000s, trying to log into my hotmail account (never having failed to log in before) and getting a "locked out due to too many bad passwords". So someone, only knowing my user account name (which was the same as my email address), locked me out of my own account. The problem was, I couldn't remember what my recovery accounts were (I eventually figured it out).
Got home, pulled out my phone, and it had a message that it was locked for several hours due to so many failed passcode attempts. Incredibly annoying.
Still, only happened once in well over a decade of owning an iPhone.
I was mostly frustrated that there wasn't some alternate way of regaining access, like via my Mac or iPad logged in with the same Apple ID. Or that the failed passcode attempts didn't start eventually playing a loud alert sound or something on each failure.
(The login keychain is encrypted using the user's password, so it's reasonable to create a new one when the password is changed - otherwise, you end up in a situation where applications constantly pop up prompts for a password the user doesn't know every time they try to access the keychain, e.g. to load saved passwords in Safari. I've seen this happen on older versions of macOS and it's positively infuriating.)
What happens if you just set up the device as a new machine and login to your iCloud like normal?
I'd probably opt for a more defensive action here and just rename it (like the original reset did).
Going in to fix a service that uses sqlite and seeing 5 other times I recovered data or was making a change is always fun.
This assumption, by a clearly technical person, is a fundamental problem that keeps "the rest of the world" locked in to centralised services where that is true, and where that master key can be used against them by law enforcement, fascist regimes, and surveillance capitalists.