You probably received one of the common lies along the lines of "We're going to sell your phone no matter what you do, but we want to 'help' you by removing your data from your phone. If you don't do as we say, all your data will be sold on the dark Web."
Assuming that your phone was locked and passcode-protected with a passcode that the thieves did not know, and could not easily guess (e.g., not "123456"), their chances of getting at your data are very slim and none. Once the phone learned of the "Mark as Lost" request, if they didn't know your Apple ID and Apple ID password, and weren't able to trick you into revealing them or removing your device from iCloud, their opportunity to even get to a screen where they could make futile guesses of the passcode would be gone.
They just want you to think they have access to your data.