Can thieves access my stolen iPhone if it's password protected?

If the phone has a passcode and was locked they can’t get into it. You should put the phone in Lost mode, but do not remove it from your account.

However, Beware of a common phishing scam: You may get a text or email from “Apple” or “Apple Security” (or sometimes “Police”) saying your phone has been found and to click on a link to see its location. This is NEVER from Apple or from law enforcement; it is from the thief or fence to steal your Apple ID and identity. Delete any such message without responding to it. Apple never gets involved in lost or stolen devices→Avoid phishing emails, fake ‘virus‘ alerts, phony support calls, and other scams

And here is more information about what to do when your phone is lost or stolen→If your iPhone, iPad, or iPod touch is lost or stolen - Apple Support

Only if they guess your passcode.