Don't panic.
You have already covered all the prudent steps, in particular in changing important account Passwords. As described, you may have gone one step too far if you have deleted the device from your AppleID account; once deleted from your AppleID account, you will lose all ability to remotely managed and/or trace the iPad.
Assuming that you have not deleted the iPad from your AppleID account:
Locate a device in Find My on iPad - Apple Support
Here is Apple’s advice for lost or stolen devices:
If your iPhone, iPad or iPod touch is lost or stolen – Apple Support
Use the Find My app to locate a lost or stolen device – Apple Support
If the Find My iPad feature was enabled prior to it being “misplaced”, then if active, you would stand a good chance of locating it.
However, if the feature was not activated prior to being misplaced - or the iPad has been inactive for more than 24 hours, the last known location will not be available - and the opportunity to use technical means to recover the iPad may have been lost.
An iPad that has been instructed to erase using Apple’s Find My service will only erase when it receives the command to do so - this, logically, being determined by the iPad having an active network connection. If the Find My service indicates that the erase is pending, then the erase command has not [yet] been successfully delivered to the iPad; the status will change when [if] the command is successfully delivered to the device.
Nobody can gain access to your iPad without successfully entering the correct device Passcode - and for this, there are a limited number of tries before the iPad will automatically become disabled. As such a brute-force attempt to access the iPad, by guessing the correct passcode, is highly unlikely to be successful. Only if your device Passcode is known to whoever finds your iPad will any locally stored data be at risk of discovery.
iOS/iPadOS is architecturally designed to protect the owners data.
All locally stored data is encrypted; by design, the only copy of the encryption keys necessary to access local data are held within the Secure Enclave - the device security chip. The device Passcode unlocks the Secure Enclave, which in turn releases the encryption keys to the Operating System while the device remains unlocked.
If an incorrect Passcode is repeatedly entered, the Secure Enclave automatically wiped and the device disabled - an operation that erases all stored encryption keys. This is known as a crypto-erase. Once erased, all locally stored data is permanently beyond reach and cannot be recovered.
