Lost my Encrypted mobile phone
TBH the answer is 'Yes' he can use it after factory reset.

As we know that it is needed for an android device to re-login from the same account as it was previously logged in before doing a factory reset or called it as owner's account, but one can still use other account to log in and set up a fresh android after resetting the device.

However, Google always providing patches to these vulnerabilities but it is not enough as of now. 
There are various guides to bypass FRP.

Coming to your data on SD card. If it is encrypted no need to worry about data.

It may help you, read here more about 'Adoptable storage' and 'Portable storage'.