Regarding a Stolen IPhone and Scammers

Long story short - A friend of mine a few months ago had their phone stolen. For a while they got obvious scam texts phishing for the Apple ID password to get past the activation lock. Then eventually they stopped - and a while later the phone ended up overseas. A while after that, my friend got a text from an email saying that they bought his iPhone and that the phone still has his Apple Pay info, personal info, and phone number on it. He got very anxious about this so I have been reassuring him it’s just a scam, these are the points I made to him:

1. He got a notice after we tried to erase the phone that his Apple Pay info was wiped off of his phone directly from Apple, so it wouldn’t make sense for it to still be on there.
2. If this is just a person who bought his phone, how would they be able to get past activation lock to find his information. And if they did get past activation lock, why would they even bother texting him. The whole point of the phishing scam is to get past activation lock.
3. So using a SIM card exploit a while ago, the original scammers found out my friends number to bug him on his new phone (he kept the same number as before). I’m assuming when they sent the phone overseas they gave the new scammers his phone number. Once again, they would have to get past activation lock to find that information now, as the SIM card has since been wiped before the new scammers got their hands on the phone.

Could someone just confirm that the 3 points that I made to my friend are accurate?

And this is most definitely a scam correct?

In addition to that, I would like to ask 3 questions:

1. Is there more to the phishing scam than we know of? Would the scammer still have a reason to text him if they got past his activation lock?
2. Even if the scammer did manage to get into the phone, since the SIM card is wiped would my friends number even be able to be found out? Is it still saved on the phone even if it is usable?
3. And finally, is it possible that someone could get past the activation lock with no Apple ID password? I’m assuming at least with these scammers, they wouldn’t be bothering with a phishing scam if they did have a way to do that, but I don’t want to be too confident that his information is completely safe if it’s not.