Q:

Can a stolen Android phone with USB debugging enabled have screen lock bypassed?

My Android (8.0) phone was pickpocketed from me yesterday.  It was immediately turned off by the thief and when I tried to locate it using Find My Device it shows as offline.
As a programmer and a security enthusiast, I started to worry about what data can be vulnerable on the phone. I had a screen lock on but it didn't have full-disk encryption enabled (my bad, I know).
I saw on the internet that people can bypass the screen lock using fastboot and deleting some files, but does that only work for rooted phones, or am I vulnerable too?
I probably had USB Debugging enabled as I developed an Android app in the past and tested it on my device.  However I remember that you must trust the computer before using it, so maybe this doesn't make my device more vulnerable?
My phone wasn't rooted though, so I believe that for the thief to bypass the screen lock they would need to unlock my bootloader which would definitely wipe my data.
I'm only worried about the data.  If the only way to bypass the screen lock would be to wipe the data, then I'm ok.
What are your thoughts on this?

A:

A sophisticated threat actor could potentially try to exploit the Android Debug Bridge's authorization protocol by switching your phone's storage media to another same model phone with already active ADB/ADBD authorizations (based on HWID like the network chip's MAC address) and maybe some additional tinkering. 
From then on, provided he knew how to get there, even an encrypted device might be under threat of full decryption. Depending on multiple factors, like OS version, startup default mode (lockdown or not), ADBD startup policies... 
The key factor here is the fact nothing is encrypted and USB Debugging is enabled. 
Essentially anyone with slight IT knowledge should be able to access everything in there. 
I'm fairly certain your phone will get wiped and sold. 
Protips: 

No root.  
No debug. 
Latest updates. 
Full device encryption.
Disable PIN/Fingerprint/Face unlock (Either completely disabled or
lockdown-only disable)
Strong password.

*This should take care of the unfortunate event where your phone is not in your possession and not communicating through any channels (e.g. SIM removed, WiFi disabled). 
Optional: 

Tasker Automations in case you need to remotely wipe your communicating phone.

e.g. perform rm -f /storage/emulated/0/ when "X" message is received by text, effectively launching wipes from SMS/GSM instead of Data/WiFi
e.g. Launch camera silently to snap the person's face/geolocation

Keep an eye on Google's Find My Phone. 

A:

Without full-disk encryption, your unencrypted data can be read without recovering the pincode. Enabled USB debugging, definitely, extends the attack surface, but it's not necessary for a determined and skilled thief.
But most likely, they will wipe everything and resell your phone to get the daily dose.

A:

Without the encryption, your data can be trivially read out using a flash adapter such as this one:

Removing a flash chip is a 5 minutes job on a hot air rework station.
Of course, this assumes that the thief decides that the data on your phone is worth more than they could get by wiping and reselling it. If you have an old inexpensive phone or it has suffered a lot (cracks on the screen / case, broken buttons, etc.) it makes data theft more likely.

