This person is clearly well-intentioned, so I don’t think an exploit was the cause of your phone being unlocked. If they knew an exploit it’s likely that by now everything about you would’ve been compromised already, like you would’ve lost access to your accounts and all your money would be gone. This person probably unlocked your phone by using your pin code, so either it was a very common pin code, or something suggested here, like smudges on your screen revealing the pin code, or highly unlikely, they guessed your pin code. Anyway, it’s better safe than sorry so check if your OS’ been tampered with using the GrapheneOS auditor app. Even if it hasn’t, you should back up everything and factory reset it just to err on the side of caution. And in the future, use an 8-10 digit pin code with pin scrambling enabled.