iPhone stolen, Activation Lock was turned off but iPhone is still iCloud device list. Can it still be used by the thief?
Yes. The finder / thief can use your phone unless you protected it with a passcode lock. 

If you cannot use the iCloud find my iPhone app to remotely lock the device, your data is at risk. 

If you chose a passcode, hopefully the finder can't guess it. Apple does limit the wrong guesses, so the casual thief can't brute force it. 

If you can't secure the device remotely, start on changing all the passwords and monitoring all the services and apps you stored credentials on the phone. 


banking
social media
email
work apps and files
things like contact lists and social security numbers


Going forward, get an app like 1Password so you can easily change all your compromised passwords and limit the damage that losing control of your email entails. 

See: Wiping a stolen iPhone that wasn&#39;t connected to iCloud and Stolen iPhone: what is the security risk? for more tips.