Returned my iPhone to employer. But I left it in a hurry and forgot to wipe clean. Then, trying to mitigate the damage I deleted iphone from my devices assuming that "two step authentication" meant having security questions on my account. what can I do ?

You cannot add it back to your iCloud list of tracked devices without having it in your hands. And your AppleID has nothing to do with accessing the device itself. If there was a screen lock passcode enabled, then they cannot get to the contents. Otherwise, with no screen lock passcode in place sure, anyone with it in their hands can swipe to unlock and browse the content.

But it is your screen lock passcode and fingerprint that secure access to the device contents themselves, not your AppleID.