A phone can require a passcode and still display a message excerpt on its lock screen. Device access and notification previews are separate controls. The useful question is what a person beside the phone can read without unlocking it.
Apple provides preview options including Always, When Unlocked and Never. Review the global setting and relevant app settings rather than assuming that silencing notifications hides their content. Notification previews can include message text or calendar details.
Set up a harmless test message, lock the phone and observe it before authenticating. If Face ID recognizes you while you look, the displayed result may change; that is part of what the When Unlocked setting is meant to do.
A hidden text preview does not necessarily hide the app name, notification count or every Live Activity. Review the screen as a whole, especially for travel updates or other information you do not want visible on a desk. Use a practical setting you will keep, then repeat the check after changing a relevant app's notification preferences.