Someone here needs to move on from this relationship.
Right now, your devices can be permanently remote wiped, completely released from Activation Lock and your control, all your iCloud backups can be deleted, and (if you’re using iCloud Keychain or if they know your device passcode) all of your social media and other passwords are exposed. All of your passwords. Among many other messes awaiting.
This is a complete and full security breach.
To answer your question, no, there is no means to have a “smaller” breach or less-catastrophic security breach here.
As for WhatsApp, access to that is covered by your WhatsApp credentials, and only secondarily via iCloud Keychain or similar password manager access, and the password store.