Received password reset email though I didn’t request one?

As Jakke mentioned it depends on your mail service, iCloud is probably fairly secure but I am no expert about that.

Often there is an option for two factor authentication, which means you need both a password and a physical security key to login, or authentication code generated by an authentication app.