The answer is that I've no idea how good those things are at detecting spyware, but I wouldn't bet my banking password on it.
I actually doubt that any spyware would be installed from the Google Play Store as that would make it too easy for you to spot (unless it's able to edit itself out from the list of apps you have downloaded from Google, which I'm doubtful of). But of course if you left someone with the device long enough they could download and install something from elsewhere.
Your phone only has a firewall if you added one. If someone knows the url of a spyware vendor - or somewhere they keep their own copy - then if you give them access for long enough they could install it and set it up. I'm not saying that is what happened, just that if you give your unlocked phone to a bad actor and leave them to it you have no security, as any protection you might have they could turn off and then turn on again when they were done so that you couldn't tell. The first rule is that you just don't give other people access to your phone - not just unauthorised access, unless you really trust them you don't give them access full stop.
What can you do? Well as Danny said, unless you left them alone with your phone, a computer, a USB cable and plenty of time they won't have rooted it(*), so a factory reset will clear everything - of course it will also erase everything on your phone, so you want to be sure you have a backup of your photos, messages etc first. If you are seriously concerned about spyware you'll change your passwords afterwards. And if you haven't enabled 2 factor authentication on your Google account, do so: if someone has access to your Google account then for many purposes they don't even need to put anything on your phone. Note: we occasionally get people who don't know their own Google login and password: if you are one of those don't reset the phone until you've worked them out, as you'll need them to get back in.
Not trying to scare you there, I've no idea whether you have spyware or not, just saying that if you have there are a number of steps you need to take to get rid of it and protect yourself against any leakage that might have occurred already.
(*) If your phone is rooted then they can put spyware in the system, where a factory reset won't get rid of it. But unless you have a really old phone you will need a computer to root it, if it's even possible in the first place.