The personal data on the phone should be safe, unless you didn't write your password on the device nobody can access it.
The SIM should be deactivated, and you have done this already.
As Graphene has no Google Pay, unlocking the phone for third party NFC payments is necessary. As this can't be done without the password, it's enough to manually disconnect the payment app/phone via your payment provider/bank. Many times you can do that yourself on your bank accounts webpage.
You could also tell the police you lost it. So they know if the phone is ever used in a crime that it is a stolen/lost phone.
Contact lost and found offices during the next weeks, sometimes people bring found items there or give it to the police-there are still more honest people than criminals, so chances are good that someone finds it and gives it back.