How did my son turn my hotspot on, on my iPhone from his iPhone

If you are logged into the same Apple ID and are in proximity of each other, when you go to Wi-Fi in settings, you will see the phone in question, and you would be able to connect to it, even without the password. That is because it is expected that if you are logged into the same Apple ID, then they are your devices and would not need the additional security of a password. See this support document, the part about Instant Hotspot for a better explanation. Use Continuity to connect your Mac, iPhone, iPad, iPod touch, and Apple Watch - Apple Support

Are you logged into the same Apple ID? If so, that is how your son would have connected to your phone to use Hotspot.