They can't access any data on a locked iPhone.
They can't access your iCloud or remove activation lock without the Apple ID password.
See: Activation Lock for iPhone, iPad, and iPod touch - Apple Support
One common scam is to send a message (possibly indicating the phone is found) that appears to be from Apple and containing a link to a website that appears to be Apple. If you respond and use that link, you divulge your Apple password and they can use that to turn off Activation Lock and then resell the phone. They can't access data on the phone but they could potentially log into iCloud and access data there.