Stolen iPhone phishing

Hi,

My iPhone was stolen a couple of days ago and I received a text today from ‘apple’ stating that it had been found with findmyiphone. I stupidly followed the link and entered my details and a few minutes later, the device was removed from findmyiphone. I realised quickly that I was phished and changed my Apple ID password.

I have 2 questions I would really appreciate some guidance on:

1) By falling for the phishing attempt, is there any way the thief can gain access to the device itself? I have a lot of sensitive information stored on the phone so this is my main concern. FYI, the phone was protected with a 6 digit passcode and fingerprint ID

2) despite the phone not showing up in find my iPhone, it’s still listed as one of my devices on iCloud.com. The Apple Pay cards still show “pending erase”. Does this mean the phone is still activation locked?

Thanks in advance for any insight you can give me.