It’s fundamentally impossible for a remote website to scan your Mac or iPhone. That’d be a catastrophe. Were that possible, the scammers would simply upload everything. But since they can’t do that, they convince folks to install their products—variously the malware, the “anti-virus”, or the rest.
Add-on VPNs designed to allow your traffic to be concentrated and scanned.
Apple Security” doesn’t send those messages.
Calling telephone numbers can be faked too, as can sending email addresses.
What will happen with the data you just handed over, who knows? With various scams, I’d expect there will be attempts to phish them. But your contacts are probably now targeted for scams, if your contact database got uploaded.
Get rid of what you installed, get rid of the VPN, and ignore those messages.
Put differently, I’d consider this a serious security breach—how bad this is depends on what got installed. This whole sequence is very reminiscent of malware, if this is not actual malware.
Recognize and avoid phishing messages, phony support calls, and other scams - Apple Support
Effective defenses against malware and other threats
