to commonly asked questions.

Someone has logged into our AppleID

We just got a notification that someone on my son's phone is signed in using our AppleID. We checked with the only people our son knows. What do we do? We are going to change the password.

Interesting. If he has two factor authentication on then there’s probably a simple explanation.  If he didn’t then it could be problematic. You are doing the correct thing to change the password. If his Apple ID is signed in to an unaccountable device, you can go into and wipe it.
This image is a theme.plist hack