The user partition is encrypted by default, so a Maintenance Mode user has no access to user data. Maintenance Mode can only be enabled if the device is unlocke

The user partition is encrypted by default, so a Maintenance Mode user has no access to user data. Maintenance Mode can only be enabled if the device is unlocked, so a thief could only enable it if they have your device password or they grab your device while it's unlocked; obviously that's a more general attack vector. The device can still be remotely located, locked or erased while in Maintenance Mode.