The journalist:
- Marked the phone as lost;
- Wiped all data;
FTA: As quickly as possible, I did all the things you’re supposed to do when your phone is lost or stolen —- mark it as lost, cut off service, and remotely erase it
She did not, however, remove (delete) that iPhone from her iCloud account, which means that the iPhone can't be factory reset by the thieves because "FindMy" is still activated.
FTA: As long as I didn’t remove the phone from my Apple account or the Find My app, the phone was essentially bricked to anyone without the passcode and my iCloud password
The iPhone did not, at any time, leak any personal information. What probably happened is that she had a SIM card on it, and from ejecting the tray and putting the SIM into another phone they managed to get her phone number, from which they started contacting her with the threats/scams.
I think this wouldn't even be possible with a e-SIM in the newer iPhone models.