Can someone access my lost iPhone by resetting the passcode?

No. Resetting the passcode requires erasing the device entirely. At that point the data is gone.

They would still need your Apple ID and password if you have Find My tuned on, as they would encounter Activation lock.

Beware of a common phishing scam: You may get a text or email from “Apple” or “Apple Security” (or sometimes “Police”) saying your phone has been found and to click on a link to see its location. This is NEVER from Apple or from law enforcement; it is from the thief or fence to steal your Apple ID and identity. Delete any such message without responding to it. Apple never gets involved in lost or stolen devices.