The other vulnerability is the phone itself. It often stores all the owner's accounts, logins, passwords. Anyone who can get past the screenlock code has full access to everything the owner lets it access, plus a history of everything it's been used for and all the contacts, messages, calendars, notes the owner lets it remember.
I don't know if this is specifically what happened in this instance. But it's a serious risk which most people never even consider.
It's not hard to acquire somebody else's phone for a short time, if you're persistent enough to take the opportunity when they're inattentive. While you've got the phone you've got access to the unique number printed on the SIM card. The owner may have let you use the phone to make a call, leaving it open and unlocked. Or you may have observed the owner entering his PIN/code. Or you may know the person well enough to accurately guess the code.
Scrub the number off your SIM card, you'll never need it again once the SIM has been activated. Change all your passwords and secret questions and stuff. Try to use another phone number for 2FA (and erase any history of that number on the phone itself) so you always have a hidden security option and disaster recovery option. Use the screenlock religiously, and change the key on it every time you think it might have been compromised. Use all the security PIN options the phone offers so you can lock access to settings, "About..." information, and all the rest. Don't let other people use your phone - or at least supervise their activity on your phone closely - unless you're married to them. Run malware scans on all your devices to ensure you're not running somebody else's keylogger.
Even if you're surrounded by people that you trust, be aware that you can't necessarily trust all the people that they trust.
