Against their own advice, the moment it is stolen you should erase it from Find My as a priority. Until that is done it can be used to authenticate with your iCloud account as an MFA device and can then be removed anyway if they get past the device lock. In that window the security posture is somewhat unknown. I'm sure there is a good market of off the shelf exploits which can leverage that in some way, despite Apple's excellent general efforts on this front so far.
The key thing is to protect your data first and that means wiping it remotely. Leave it attached to your iCloud account device list though because that'll leave the provisioning / device lock in place. I'm sure they have a way around that now but it'll make it more difficult and devalue it for the thief at least.