Gonna need to know more. What method do you use to lock your phone? Is it rooted?

Also: did they return the phone to you, or to your friend? Could it be your friend who went through these apps?

This person is clearly well-intentioned, so I don't think an exploit was the cause of your phone being unlocked. If they knew an exploit it's likely that by now everything about you would've been compromised already, like you would've lost access to your accounts and all your money would be gone. This person probably unlocked your phone by using your pin code, so either it was a very common pin code, or something suggested here, like smudges on your screen revealing the pin code, or highly unlikely, they guessed your pin code. Anyway, it's better safe than sorry so check if your OS' been tampered with using the GrapheneOS auditor app. Even if it hasn't, you should back up everything and factory reset it just to err on the side of caution. And in the future, use an 8-10 digit pin code with pin scrambling enabled.

Was it perhaps unlocked when you lost it?

I know I've set my phone down unlocked a few times; particularly at work (in a warehouse).

Is your pin something like 1234? Do you have emergency contacts set up? Do you have a setting to not lock the phone until very long? Or a smart unlock based on location or any other automation setting? An easy password hint pops up or something? Perhaps your parents forgot to mention you had a twin, who face unlocked it.

Regarding app usage, my guess is they tried to see whom to contact to give your phone back, or map history, the banking app could be a touch by mistake too.

Do those contacts happen to be your ICE? Some phones will allow those from the emergency dialer without unlocking. Don't know about grapheme.

My guess would be that maybe it wasn't locked in the first place or they happened to randomly try a few pin combinations & got lucky..

I think those are most likely scenarios.

Now if you're some very important person who could be target then I wouldn't assume what I stated previously & instead assume the worst.

They clearly seemed to mean well. Maybe you can ask?

I imagine you may have lost your phone while it was still unlocked. It's possible that there's a Graphene lock screen bypass out there, but I doubt someone with such knowledge will use it to return your phone to you. Most "hacker" style lock screen bypass I imagine someone wanting to return the phone will do is checking for smudges on the PIN area of the lock screen and determining the code from that.

To combat someone unlocking your phone through smudges, you can enable PIN scrambling.

Perhaps they simply took out the sim card and inserted into another phone, giving them access to contacts (that could have been saved into the chip instead of the original phone)?

When you find out let me know

This maybe a strange suggestion. Aside from the banking app, it seems like the maps and contacts app were used with good intentions to return the phone. The person returned the phone to your friend, so clearly had good intentions. Your friend may have the phone number of the person in their call log when they called to return, unless of course they used your phone to call. If possible, have you thought about calling that person and asking about this just out of curiosity?

Does your phone have a physical SIM and if so are there any contacts stored on it?

Any chance the phone was stolen and not lost? Got anyone in the family working for the government or anything unusual like that. Just a thought.

If someone calls you and theres a missed call notification can they just click it to call back without unlocking the phone?

Oh i didnt notice they went through other apps. Maybe they were watching you and saw you input your pin and then stole it and checked your stuff to see if they can get something useful and then returned it?

Is it possible that something else was installed to the phone? If they manage to hack it open, then potential reason to return it to you is to spy on you.

Maps and signal is like they were trying to contact somebody and see where you lived to return the phone. Banking is weird since you can't do anything without biometric anyway.

Ask the graphene devs.

Unrelated. Have you considered using a work profile?

That way you can have two factor authentication when unlocking your phone. You could use a PIN code for the main unlock, and a biometric for apps in the work profile. That way you would have to have both something you are, and something you know.