This is why updates exist.
A security researcher has located a zero-day bug that could potentially allow an attacker to steal your Apple ID password from your AirTag:
Apple’s “Lost Mode” allows a user to mark their Airtag as missing if they have misplaced it. This generates a unique https://found.apple.com page, which contains the Airtag’s serial number, and the phone number and personal message of the Airtag owner.
Apple has yet to officially comment on the issue.
Stay tuned for additional details as they become available.
Via The Mac Observer and Medium