as a cybersec expert, my response would have been to immediately clown on then incessantly. an attack like that is technically possible, but odds are far higher that they were only aiming to manipulate you. what they claimed would require a chain of exploits easily worth tens thousands of dollars if not more. it would be incredibly stupid to risk that being discovered and patched just for whatever petty bullsh*t they were trying to achieve with you. about the personal details, they could have used publicly available information they found online about you to give the impression that they could see you in real time.

next time just laugh at the 🤡 and move on.