I checked with the root checker app and it says its not rooted

My &#x27;friend&#x27; had borrowed my phone for a day and returned it the next.(I gave access)I then used my phone as usual,
After a few months, i started to realise that my friend was getting to know things i had only shared on my phone 
i thought it was coincidence at first but they were right every time, so i figured it was something to do with them borrowing my phone.I then started to check out my phone, it came out completely normal 
They also told me that it cant be removed.I also had a few problems with other &#x27;friends&#x27; trying to spy on me using a bad app and flashing a bad os but I ended up figuring it out and getting rid of it by removing the app, factory reset and a flash of a clean os(somehow with the bootloader locked).They also mentioned that it couldnt be done on iphones for some reason and had asked me for the model of the phone before.
My initial thought was they may have access to my google account so i created a new google account on the phone after flashing it with a clean os but i was eventually locked out of my own account because my password was changed, even though i had used a different password and wrote it down.I own a motorola which has android 13 which still recieves security updates, i dont use any banking apps on it.
It looks perfectly normal and not replaced.I am looking for advice for as what to do now to get the phone back to normal and understand what could have happened to it.
(Solution for this other than getting a new phone)

Understanding physical attacks on Android phones