Change your passcode, as the little person knows it. I’d go six digits or quite possibly a longer password, as longer makes it harder to shoulder surf. With Face ID or Touch ID enabled.
Probably also knows some of your passwords too, so change the most important and most inviting of those, and particularly also change your Apple Account password.
After changing your Apple Account password to a new and unique and robust value, might also want to require a password in the App Store as a secondary defense, as the alternative can be expensive.
Maybe also reset and re-train Touch ID fingers if you’re using that on any devices.
But… your passcode is compromised. Maybe more is compromised.