Second, the phishing text messages.
On the second day, every one of my emergency contacts received the following text message. I opened up the URL myself and it was a full blown Find My web UI phishing page, which I assume was trying to get my Apple ID password!
For context, if an iPhone is Find My enabled and remotely wiped, it cannot be reactivated without the original Apple ID login. So unless they have my Apple ID, my phone is a brick to them. This was a step up from what I was expecting.