They don’t. They’re using another phone and texting the original owner, threatening them, in order to scare them into unlocking the device.

When you boot the “Lost” phone, it asks for the password of the owner’s iCloud account. There is probably an information leak where the original email or phone is presented and the thief can track the original owner through that.