This is why I don't sign in or enable 'find my' on any of my devices. Apple even has a backdoor which bypasses the encryption, allowing them to wipe a device in store.
Logging in takes control of your device out of your hands.
It sounds like they responded to the complaint by unlocking the number, allowing her to port it out. Not by restoring her access. Not much of a deterrent.
> You may use or modify the software only for non-commercial purposes
When one speaks of 'using' software, only one thing really comes to mind. Seems like an easy fix.