So. I am in waiting mode.
In the meantime I have changed my password and financial information from PSN.
What else can I do?
I imagine they are going to download the games on my PSN if they can (not sure if they can if they can't log into my PSN account now that the password has been changed.).
They probably download my stuff onto their PS4 and then play it on their PSN account. They had download Battlefield: Hardline, DriveClub and Street Fighter V.
What do I lose by not having my PS4 set as primary? What else can I do to protect my PSN account?
Edit: I think I can edit their device nickname. This could be fun.
Did you deactivate all PS4s? Change your password, deactivate all PlayStations, Activate yours as Primary...
Sounds like you did everything you can. By the way, do you have a password for when you log in? Like, a Dualshock input code?
If your PS4 is not primary, you can't play it offline. So if his was primary...then if you lost connection, you'd be locked out of your games.
You should have your PS4 as primary, and there's no real reason why your PS4 log in should be anywhere else.