Your phone is protected by an account you forgot about.

The email address tied to your phone account is the recovery key for everything on it. If that email is unsecured, your lock screen is theater.

Account recovery bypasses device security entirely. A forgotten or unsecured recovery email is an unlocked backdoor. MFA on the phone itself is meaningless if the email controlling your Apple ID or Google account has no MFA.

Find the email tied to your phone. Log into it. Secure it with MFA. If you can't get in, start account recovery now — before someone else does.