Also probably a good idea to delete all your 2FA entries you may have in Goog Authenticator on the phone. Or they may want to look into those accounts too.

Best to just wipe any device and restore from backup.