security breech

I booked a Genius Bar at Apple in Bath last week and they told me my iPhone XR was irreparable: the hardware had failed...i was offered a replacement for £370 which I couldn't afford. The phone was 2.5 years old but out of warranty. I was told explicitly that this XR was dead and was unable to be rebooted...

So thinking this was a dead phone I sold it on Ebay for 'spares or repairs'...someone brought it for £50; and I proceeded to start a new contract with EE with an iPhone 11 as I took the word of genius 'technicians' that my XR was dead.

To my horror the person who bought it on Ebay had managed to restart my XR and wanted my passcode from me apparently so they could wipe the phone and sell it on...

They told me all my data on my phone now belonged to them…and they threatened me that it wouldn’t be safe unless I gave them the passcode. If I didn't give them the passcode they would use software to crack the code.

I am traumatised by this experience as the person was very aggressive and they still have my phone with all my data on it, now rebooted. I am completely appalled that Apple told me this phone was irreparable and now I'm in this terrifying predicament where all my personal data let alone photos of my family and children are at risk. HELP anyone?