It was deleted. Here is the OG Text: "Ok so this just happened. Buckle up. About a month ago my wife broke her pixel phone. It couldn't be turned on so we couldn't wipe it. We contact Google and used the device care to get an RMA. Today someone posted nude pictures of my wife and I to her social media accounts. They accessed her Google account and tried to lock us out. They used her PayPal to send someone $5 (a test…
If the phone doesn't turn on you can still queue up a wipe from Find My Device which would've prevented this.
And no, it was clearly not "password enabled".