Here is Apple’s advice for lost or stolen devices:
If your iPhone, iPad or iPod touch is lost or stolen – Apple Support
Use the Find My app to locate a lost or stolen device – Apple Support
An iPad that has been instructed to erase using Apple’s Find My service can only erase when it receives the command to do so - this, logically, being determined by the iPad having an active network connection. If the Find My service indicates that the erase is pending, then the erase command has not [yet] been successfully delivered to the iPad; the status will change when [if] the command is successfully delivered to the device.
If you have received an Activation Lock notification, someone has attempted to reset the iPad or is phishing for your Apple Account (AppleID) credentials. Ignore and delete the email. As you have already changed your Apple Account Password, you have already protected your account from compromise.
Nobody can gain access to your iPad without successfully entering the correct device Passcode - and for this, there are a limited number of tries before the iPad will automatically become disabled. As such a brute-force attempt to access the iPad, by guessing the correct passcode, is highly unlikely to be successful. Only if your device Passcode is known to whoever finds your iPad will any locally stored data be at risk of discovery.
iOS/iPadOS is architecturally designed to protect the owners data.
All locally stored data is encrypted; by design, the only copy of the encryption keys necessary to access local data are held within the Secure Enclave - the device security chip. The device Passcode unlocks the Secure Enclave, which in turn releases the encryption keys to the Operating System while the device remains unlocked.
If an incorrect Passcode is repeatedly entered, the Secure Enclave automatically wiped and the device disabled - an operation that erases all stored encryption keys. This is known as a crypto-erase. Once erased, all locally stored data is permanently beyond reach and cannot be recovered.
