[reidmain]

They have potential access to the password manager on his Mac as well.

If you use a good password manager you should have the time to reset all your password so that if they somehow manager to crack the manager all the passwords in there are worthless.

Also if you immediately ask iCloud to lock your iPhone they can't use the any of the two-factor authenticators without connecting to the Internet which would brick the phone.