Getting your Apple ID password phished when two-factor authentication is not enabled too often ends this way; in a data integrity and privacy catastrophe, and here unfortunately also combined with device loss.
Just as soon as that Apple ID password is compromised, then Find My, remote locking, remote wipe, everything is unavailable to you.
We can provide sympathy, and can provide pointers to (maybe) recover from a compromised Apple ID.
We can’t fix this.
Nobody can get back what you have lost here.
And yes, if the thief was inclined, everything here was copied, the stolen device permanently disassociated from your Apple ID, and whatever data associated with the compromised Apple ID was erased should the thief have wanted that.
At the thief’s option, the Apple ID can further be permanently deleted, bricking other associated devices, too.
Unfortunately, the two Apple recommended answer above are incorrect for this case, given the reported successful password phishing.