While still in “Pending” erasure status, thief contacts victim and using threats, convinces them to remove the device from their list so that the Activation Lock is disabled.

The phone is obviously now un-bricked and usable by this individual. But besides the obvious loss of the device, what is the risk of data being compromised now?

Wondering what next steps look like here – are they likely to wipe it themselves? Will the pending request be nullified by removing the device? Will the original users data remain on the device?