I recently sent in an MBP for repair and wondered the whole time it was gone if someone was viewing my private information.
One time in the past I allowed a third party Apple authorized repairer to keep my MBP overnight to repair. They asked me for my sign in password although I had removed the password and disabled Find My.
That's exactly the reason that whenever I need to send in a Mac for repair I create an extra admin account for the repair shop. They could change the password of my own admin or my work user but they could not change it back. So, it would not go undetected, if they logged in in one of the other users.