Stolen phone and passcode

My phone (iphone 14 pro) was stolen, and the thief also has the passcode (which I know was too obvious - lesson learnt). She went in and changed my AppleID within seconds of the phone being put into 'Lost' mode, and she removed it from 'Find My'. I'd already deactivated my number with my provider, and I changed my AppleID myself again while on the phone with Apple as soon as I discovered what she'd done. I know I have little chance of recovering the phone - though I did get a screen shot of its last location before she removed it from 'Find My', and have added it to my police report, along with the IMEI number. My question is, what will the thief still be able to access on the phone if she doesn't have the AppleID, and will she be able to change my AppleID again without access to my phone number or my ipad, which is linked to the same account? I'm most concerned about credit-card data in my Wallet or apps on the phone. I've already changed e-mail and bank account passwords.