Basically, yes.
Additionally, you can reset your iCloud password with just your device passcode and the device itself, so they then lock you out of iCloud so you can lockdown the device, report it as lost/stolen, or remove it from your account.
Finally, they are able to log into your services (e.g. banking) using saved passwords or touchID/FaceID backed by your device passcode that they have.