[Android Q&A, Help & Troubleshooting] Simulta:
Hi,

First of all I am really sorry for the questions and the beginner kind of questions. I really need your help. Your help is appreciated.

Please do not calm me down (is reassure the right english word?)! I just want to hear facts and answers regarding the truth/reality..

I have got a Samsung Galaxy S9 Plus (SM-G965F, Duos), bought in Germany. My Android Version was Android 8 or higher, but I can only guess this part. Maybe it was older than Android 8?

It fell into water (only the bottom part) a year ago and about a month ago i gave it to a repairshop (I know that this was very late).

I did not give my lock screen code to the shop workers. I did not give them any code.

The Bitdefender App (full) was installed on the phone.

As I remembered that there was sensitive data on the phone I took my phone back the next day. Bitdefender has mentioned that there was failed access attempt to my phone. Bitdefender App took one or more photos (I can only see one) of a worker trying to unlock my phone.

I used Bitdefender, so I think the Secure Boot was disabled (I think). Is this important for my question?

The old data (before giving to the shop) was on my phone, no deletion of any file, as far as I can remember my own files.

Questions:

Could the workers of the phone service shop get any kind of access, e.g. by cracking my phone, bypassing or just trying. I mean, they are professionals or semi-professionals. My phone code consisted of four digits I think. There was no SIM-card inside the phone.

When I took my phone back the date was set to january 1st. Why that? How can that be? The Bitdefender App said that the photo was taken on 2018-01-01, 15:41 o'clock. Maybe Bitdefender takes it from the android system. Or from WiFi of the shop? Is that possible for them to connect to their WiFi without the lockscreen code? Can it be, that they unlocked the phone, and messed up the timestamp?

Is access (if possible) only via USB cable possible or wirelessly, too?

After a bit of investigation I found out that there is software to rescue data both from iOS and Android systems (For example: Dr. Fone). Maybe access it possible with software like that?

The warranty void of my phone is: 0x0. So I think that software like CWM or TWRK was not installed on my phone, am I right? And I also think that my phone was not rooted, am I right? But I have read that you can flash the full ROM, to set it back, from 0x1 to 0x0 (https://c.mi.com/thread-1898682-1-0.html)

I have read this, but I do not know if it works on my phone: https://xdaforums.com/showthread.php?t=2437946

Could they have gained access to any password, including Google and Samsung accounts?

I have researched and found out that there are several options: USB debug mode, Warranty Void, FRP Lock, OEM Lock, KG State. Do they use one of these to gain access?

After taking back my phone from the shop I did a hard reset on that phone. After the reinstallation the phone did NOT ask me for a PIN/password or google account . So, was the FRP Lock OFF?

I think I had both the Google Account and the Samsung Account logged in on this phone. So was FRP=ON ? What about other options/states, e.g. the OEM Lock?

But I changed the password from within my PC (Browser), not from within this phone. Maybe the phone had an internet connection (so that an error was shown internal on my phone, due to the password change), maybe not. Could the FRP Lock have changed to FRP Lock=OFF (due to this password change?).

What about other options/states, e.g. the OEM Lock?

A bit offtopic, but related to my problem: The shop said that they tested my phone after repairing. Microphone etc. How could they have done that without my lockscreen code? What else apart from microphone could the have tested?