The company I work for has to do it from time to time with Apple's help. We have Mac users who, for example, return locked Macs when leaving the company... we unlock them then with Apple's help.
There are actually a few ways around iCloud lock, they all aren't great for thieves:
1. An insider (hard to get)
2. Phishing the owner (your device has been found, just sign into your Apple ID on this specific login form...)
3. Physically going to an Apple Store, with faked proof of purchase, and ideally a convincing disguise
4. Resell to some Chinese reseller (particularly because China doesn't use the same IMEI blocklist as the rest of the world), and take whatever they give you, and then it's not your problem anymore
Option #3 is surprisingly popular for petty criminals.
The company I work for has to do it from time to time with Apple's help. We have Mac users who, for example, return locked Macs when leaving the company... we unlock them then with Apple's help.