Google can only relay commands to your stolen phone if it's powered on and connected (either via cellular data or wifi). If the thief knows this, they may be able to power up the phone in a location with no signal and no wifi and connect it to a computer with a USB cord to extract the stored photos (and likely other personal information).
The first/best protection against this is a secure locking method on the phone itself. If you have a PIN to unlock, it's unlikely the thief will be able to access the stored data (can't say if this applies to all phones or Android versions, but my old Samsung with Lollipop warned that ten wrong PIN entries would result in the phone resetting to factory original condition). If you have a good, strong password, it's even less likely the thief can access the contents. Even a gesture unlock is better than no lock.
If your phone has no lock set up, you need to assume that all your photos may appear on the internet. There's really nothing of consequence preventing it, in this situation.