Certain tablets and PCs, including at least the Kindle Fire and Windows 10 computers, allow you to change WiFi settings even if the device is locked and you don't have the PIN/password.
The valid use case for this is that sometimes you have to authenticate yourself to the network in order to use the device. (On Windows 10, you might have to log on to a domain; on the Kindle Fire, if you forget your PIN code, you can reset your PIN by logging in to your Amazon account, which of course requires network access.) So if your WiFi network has changed, you need to be able to change WiFi settings before you can log in.
But this also means that an attacker could change your WiFi settings to point to a rogue hotspot they control, without having your PIN/password. Then when you log in to the device and use it later, all your traffic flows through the attacker's hotspot. Even though most important traffic is encrypted these days, they can still see what sites you're connecting to.
This seems like a valid security concern, and the easiest fix I can think of is that if the device's WiFi settings are changed while it's locked, the next time it's unlocked, display a message which says, "While this machine was locked, a user changed the WiFi network to . If you did not authorize this change, you should change your machine's WiFi settings back to their previous values."
Is this a valid security concern? Has this been publicly discussed anywhere? Is there a simpler way to mitigate this security threat, while still allowing users to change the WiFi settings on a locked device?