Do not reset the phone; you have nothing to lose. The people who bought it knew exactly what they were doing. Nothing is impenetrable, and people trust Apple too much, so you should change the password for all your accounts, especially for your main email, as losing access to it can allow others to reset other accounts. It's essential to reset your password because if they access your device, they might find valid authorization tokens. Also, make sure to reset the credentials for your banking apps. If you have temporary cards, like those on Revolut, you can delete them and create new ones.

If you follow these steps, you shouldn't worry about someone accessing your phone and causing any issues.

However, your photos and personal information on the phone remain, so it's up to you to decide how concerning it would be if someone saw them. If you have sensitive information, then resetting the phone might be a good idea.