“Confirm passcode on iCloud to LOCK device” (after being stolen 3 weeks ago) Legit or Scam ?

That's a common phishing scam: You may get a text or email from “Apple” or “Apple Security” (or sometimes “Police”) saying your phone has been found and to click on a link to see its location. This is NEVER from Apple or from law enforcement; it is from the thief or fence to steal your Apple ID and identity. Delete any such message without responding to it. Apple never gets involved in lost or stolen devices→Avoid phishing emails, fake ‘virus‘ alerts, phony support calls, and other scams

Scam. That’s not an Apple site. All Apple domains are Apple.(com or country code)

they’re just trying to get your iCloud data to unlock the device.