Yes, the Find My iPhone service is working along with its various actions (e.g. Lost Mode, Erase iPhone, etc).
This leaves us with how they accessed your data and what may have happened in your case. No-one can give you an absolutely 100% certain answer and in that sense this question could be judged as too broad or opinion-based to even be on topic for this site.
However, in your question you state:
i have activated find my iphone just after they stole it and I have also activated the erase my iphone option a couple of days later.
Note the words I have bolded? It's not clear what just after means - that coud be in the order of mins, hours or more. And clearly, it's a couple of days after this point that you actioned the erasure of your iPhone.
So, presumably this person certainly had time to access your camera roll before the phone was erased.
Now, the more difficult part to explain is the fact you had a 4 digit passcode on your iPhone. I see the following possibilities:
- The easiest possibility is that the iPhone was unlocked when they acquired it and they proceeded to change the Auto-Lock settings to never in order to access the data in the immediate short-term.
- They already knew your passcode (i.e. they had seen you enter it; they do actually know you; they're in cahoots with someone you know; you previously fell victim to a phishing scam or similar; they obtained it somehow from someone you know, such as a child; etc).
- Your passcode is something that wasn't hard to guess (e.g. you use it elsewhere, it's a D.O.B., etc).
Obviously from your comments, the person sending you the texts is unknown to you - but this does not eliminate the possibility that they know of you (either through a mutual friend/colleague/etc or because they've accessed some info from other sources). And if they are strongly motivated the perpetrator may have the time, budget, and equipment necessary to try and crack your 4 digit passcode. However, this is extremely unlikely - I would almost say impossible.
This is where it becomes extremely difficult for anyone to answer your second question. In this sense it is too broad as we just don't have all the necessary info, but I suspect the answer lies in the bullet points above.