Q:

How can a lost locked phone in airplane mode be unlocked? 

I lost my Android phone on vacation that was in airplane mode (Moto G5, v7 updated).  It was protected by fingerprint and swipe.  I almost always use the fingerprint to unlock, but do very occasionally use the swipe. 
I locked it online remotely and remotely logged out of it when I realized it was lost several hours later.  The timeout interval should be only 1 or 2 minutes. 
I was hoping to recover it in some fashion, so I didn't remotely wipe it, secure in the knowledge that it couldn't be unlocked. 
So I was surprised to be contacted two days (!)  after I lost it on my other devices and accounts via an instant messaging app on the phone by someone who claimed to have found the phone and was looking for the owner. 
In shock I didn't reply and quickly used Device Manager to remotely wipe the phone immediately.  I also changed all my Google passwords for the accounts on the phone.  I checked the Gmail logins and noticed none outside of my possession.  I also checked Google Maps timeline and didn't see anything outside of my possession.  Oddly, though, in Device Manager I clearly did see the phone located in the city I lost it, but a distance away from where I was. 
A few questions: 

How could a locked phone with a recent Android OS be unlocked, taken out of airplane mode, and home screen accessed? 
How could the remote lock not work, assuming somehow someone opened up the phone within the lockout interval? 
I saw the phone in the city I lost it on Device Manager (where I executed the remote wipe).  How could it be there, but nowhere visible in my Google Maps timeline or Gmail login history? 
Is there something I might be forgetting to do security wise? 

Thank you. 

A:

How could a locked phone with a recent Android OS be unlocked, taken out of airplane mode, and home screen accessed? 

It wasn't.  The person simply pulled out the sim card from your device, added into some other device and installed WhatsApp on it.  WhatsApp doesn't have any login authentication, it will simply let anyone use it as long as they have access to sim card.  This also explains why he/she could post in one your groups and not directly PM some contact (he/she doesn't have any of your contacts). 

How could the remote lock not work, assuming somehow someone opened up the phone within the lockout interval? 

Not possible in the 1-2 minute lockout interval you mentioned.  Any kind of exploit will require at least few hours of work. 

I saw the phone in the city I lost it on Device Manager (where I executed the remote wipe).  How could it be there, but nowhere visible in my Google Maps timeline or Gmail login history? 

Maps timeline isn't 100% accurate and up to date.  Device Manager pings for real-time location.  GMail login history shows only places where you actually logged in.  You were already logged into your accounts when you went to that place, unless you didn't remove the account and added it back, it won't show login attempts in GMail. 
I don't see any signs of breach in security of your device from the information you have provided. 