Can a thief get into my phone

To supplement Chattanoogan’s excellent advice, here is how to change your Apple ID password→Change your Apple ID password - Apple Support.

your safe if you don't jailbreak your phone, but not sure why you would still seeing an erase status 2 years ago, it's possible the phone never got turned on long enough. as far as getting hacked it really hard outside of a government pulling data from a cellular provider which doesn't even need your phone. as far as your data goes unless you had no passcode, or they guessed it there's not a reason Apple would have given them assistance to get in.

If you had a passcode on your phone your data is safe. I doubt that you got an email from Apple, however, because 2FA never uses email for authentication. And spoofing Apple notifications is the primary way that criminals trick people into disabling activation lock.

And you can’t jailbreak a phone without unlocking it. And jailbreaking does not defeat Activation Lock.

The thought of one’s device “out there in the wild ” is always unsettling.

However, phone sounds as secure as you could have possibly made it, and it also sounds like you’ve done eveything right.

Going forward, I’d only suggest the following (which you might have done already):

1) DON’T remove the device from your AppleID account. (as doing so would release the activation lock)

2) DO review all details in your AppleID account; paying particular attention to your devices and recovery phone numbers.

3) DO change your AppleID password. (this will likely necessitate a round of “new sign-in required” on your current devices)

4) DO Activate 2-Factor Authentication.