Could someone have installed a ROM virus on my Xperia XA? I posted this question over at XDA forum but I hope someone here may be able to help.

I recently went on vacation and left my Xperia XA F3111 at home. Someone had access to it for over 2 weeks and installed some spyware on it. 

When I found out I factory reset the phone but I am worried he may have flashed the phone with a malware-infested ROM which will survive a reset. He had access to the phone for a long time and I am sure he knows someone who knows how to hack phones.

My phone settings say "Bootloader unlock allowed = No" which I believe (rightly or wrongly) means he could not root the phone or install a custom ROM?

Anyway, I am hoping someone can tell me if there was any way he could have bypassed this setting, unlocked the bootloader, flashed an infested ROM and re-locked the bootloader?

If this is possible, is there a guide that would help me do the same thing and re-flash the phone with a clean stock Sony ROM? 

It's a nice phone, but at the moment I can't take the risk that it has been poisoned so it may well be heading for the recycle bin.
If the settings say that bootloader unlocking is not allowed, it is impossible to unlock the bootloader, even if you wanted to. If you want to make extra sure your device is not compromised, dial *#*#7378423#*#*, go 'Service Test', 'Security' and check if all lines say [Key Ok].