Since the phone did have a lock screen, it's not a complete disaster. The only real vulnerability in this matter is the microSD card, which you've already mentioned only has her photos on it.
Unless the moron that stole her phone is on a professional level (taking phones, hacking into them to do the data mining, and then resell the phone), the odds are much more likely they just snatched it as just a matter of opportunity (hanging out at places like hotels taking advantage of situation) and their skill set will be on a pretty conventional level. Once they encounter that lock screen their options will be pretty limited. Even if they are able to get past the lock screen (again, not likely), since you've already nixed the Verizon account on that phone it won't have any cellular connectivity (and now that phone is on a black list so if it does get into the resellers market it's something of a liability). As for WiFi connectivity, since you've also enabled the remote wipe feature that will clear it once the said moron does set up any kind of WiFi network on it.
The phone could be reused but since you've taken the necessary steps to protect the data, it won't be a a matter where it can be be reused as is. The lock screen will require them to re-flash the ROM to be usable again (but again, since it's now black listed it can only be reused as a WiFi only phone).
Be sure to reset any passwords for all the online services and social media accounts she uses, just in case though.
