yes, they could’ve done a factory data reset via hard keys. that will wipe out all data. but they will need to supply your primary Google account and password when setting up.

I have personally bypassed the Android lock screen and when you wipe the phone to Android email and password log on bypass is quite simple them in YouTube videos about it there’s an exploit in accessibility via TalkBack that allows you to get past that menu and then eventually log in with your own credentials

And no I didn’t steal a phone lol I found a tablet in the middle of the street that was run over but still worked and that was when I was able to bypass Android wipe and re-log in with Google credentials

Samsung reset mine after I lost the password (long story). I was able to prove it was mine because it still responded to “find my device”, they would not reset the lock screen, but where OK with a complete reset back to factory, which was OK for me as I only used it for media and email. And any data was in gdrive.