I found my phone on when I had previously powered the device off, and was asleep for a while. While all the auditor logs are fine and the same as the last state, to my knowledgethis wouldn't account for someone who might have known my PIN or have been lucky enough to guess it (6 digits) since these would be authorised user changes.
In that case, where someone might have had access to my device and PIN for a long time window, what risks are there for the device or user space, and what can I check? All the applications seem to be untampered and I didn't have any sensitive information on there besides a VPN credential, but have experienced some bad cybersecurity incidents in the past (of varying sophistication levels) - my main concern is the risk of remote access or logging.