The federal government has had difficulty dealing with modern locked phones. The sim isn't integral to the security of the device, it's just a pointer for the carrier to route calls to. A modern phone with whole system encryption and a strong password is going to be protected against most everyone including nation state actors.

The only real advisory I like to put out with regards to phones is the same as most other devices, don't reuse passwords and for two factor ideally use something other than email or SMS which makes it far more difficult to get the second factor.

The other thing that's kind of a 'best practice' is using a password rather than any kind of biometric. The reason there is last I'd read (in the USA) the current legal guidance is that while authorities can compelle someone to put a finger on a screen or look at the device, they cannot compelle them to open the contents of their mind (forced testimony) due to the 5th amendment protections. Of course that kind of thing is more related to legal situations rather than lost/stolen devices.