If i am not mistaken they can use “find my” and enable lost mode so you can contact them in case you find a lost phone.

Providing an apple id (email) to an unknown person might be exactly what they need as a first step to hack into someone’s account. Or with some brute force they can even lock the owner’s account that is a huge headache.