Stolen phone

It locks the phone; if it is locked, no one can access the data on the phone. Also see the following from: Use the Find My app to locate a missing device or item - Apple Support

What happens if you activate Mark As Lost for your device

Mark as Lost remotely locks your missing iPhone, iPad, iPod touch, or Mac with a passcode, keeping your information secure even if your device goes missing. You can also display a custom message with your phone number on the Lock screen, and keep track of your device's location. Learn more about how to use Mark as Lost.

Use any internet browser and login to www.icloud.com

And see the Mark as Lost item in particular in If your iPhone, iPad, or iPod touch is lost or stolen - Apple Support

Note that if it had no screen lock passcode on it, some of your information may already be compromised as whomever stole it could immediately get in and read your emails, texts, contacts, view pictures, etc.

Credit cards would only be compromised if you kept them in plain text somewhere. The iPhone wallet app does not show full card numbers, and the thief could not use them without knowing your AppleID password.

Beware that if they turn it back on somewhere it cannot connect to cellular data or WiFi, those commands will not get executed on the device. The commands you set in iCloud only get executed when the device is on and connected to the internet so it can receive those waiting commands.

And if it was a pro thief, they may not have turned it off but just tossed it in a faraday bag to disconnect it (faraday bags are cheap and sold in bulk on eBay and other online sites).

I am just saying that since you did not use a screen lock passcode, entering those commands in iCloud are not a guarantee none of your personal information was not compromised. A lot of smart phone thieves, especially at large public events are looking for smart phones for their data, not the value of the device itself. They take measures to immediately disconnect the device from the network so things like trying to lock it after the fact cannot be completed. They can then access the device later somewhere it cannot connect to the network to extract the data.

Then it should now be locked and secured. As soon as it connected to the network, your pending commands should have been received and executed. It may be they turned it off after it locked on them?