How long should I keep stolen iPhone on my account?

My secondary iPhone was snatched out of my hand in a street and the thief jumped into awaiting car and sped off this happened a couple of days ago.

I immediately went home and erased it remotely and received a confirmation from Apple that it had been erased. I then bought a new secondhand phone and registered it on my Apple account having gone through a lengthy process with the phone company to transfer the phone number, reported it to the police et cetera.

I also successfully changed my Apple ID password.

This morning I received a WhatsApp message to the transferred number on my new replacement phone from someone who claimed to have ‘ bought the phone on Facebook mini market, and that because it was still on my account it kept downloading all my information’

They included photos clearly taken by a phone ie not quality screen shots - of a few contacts from my contacts app list including two or three people that I know, a couple of photos I had recently taken, and a photo of my own entry in the contacts which showed the number of the phone that had been stolen, my home number and the number of my main phone (i.e. which was not stolen). The phone snap shots also included the IMEI number… all an attempt to convince me that they had all my information.

I was asked to delete the phone from my Apple account which I refused to do.

I imagine that the thief had access to the phone for a period before the autolock screen kicked in.

In terms of security the main concern I have is how long they had access to the phone.

And I have the following questions:

1/ could they have changed the password to the phone without Face ID?

2/ when I switched on Find My my phone for that phone which is still on my account it showed it near an airport. And I imagine each time it is switched on and connected to Wi-Fi it would show its location…

3/ am I safe to conclude that it is a brick… and do I need to keep it forever on my iCloud account to prevent anyone else using it?

Finally how would I determine how safe I am in terms of compromised information… I have been to a couple of Apple stores but no one there was really clued up enough to advise me on this.

PS how easy is it to disable autolock so that they had a long period to examine information on my phone?