The person who steal the iPhone knows the phone password. If they manage to reset the iPhone using my phone password, will my iCloud be logged out? Will it reset my Face ID?
I also forgot to turn on my Find My iPhone.
Did you have two factor enabled? Does the thief have access to your recovery email?
Regardless there are things to do right away regardless so don't hesitate!
Refer to the Apple Support article:
If Find My iPhone isn't enabled on your missing device
If you didn't turn on Find My iPhone before your device was lost or stolen, you can't use it to locate your device. But you can use these steps to help protect your data:
Change your Apple ID password. By changing your Apple ID password, you can prevent anyone from accessing your iCloud data or using other services (such as iMessage or iTunes) from your missing device.
Change the passwords for other internet accounts on your device. This can include email accounts, Facebook, or Twitter.
Report your lost or stolen device to local law enforcement. Law enforcement might request the serial number of your device. Find your device serial number.
Report your lost or stolen device to your wireless carrier. Your carrier can disable the account, preventing phone calls, texts, and data use.
Find My iPhone is the only way that you can track or locate a lost or missing device. If Find My iPhone isn't enabled on your device before it goes missing, there's no other Apple service that can find, track, or flag your device for you.
My iPhone X was stolen. Will my iCloud be logged out if the person resets the iPhone using my phone's password?
Your Apple ID password (not iPhone passcode) is required to reset your iPhone. So, no, your iPhone couldn't be reset using your device passcode. However, you should be worried if you are using your Apple ID password as the device password and the person attempts to enter it when asked for Apple ID password when attempting to reset your device.
The person can however disable/enable iCloud services such as Contacts/Photos/Safari/Calendar sync etc. with access to device passcode.
Will it reset my Face ID?
It is also possible for them to remove Face ID data with access to device passcode.