It’s not “probably”, it is definitely compromised. This is now a common botnet thing, which creates System user and partially restricts you. It occurs almost instant via api on unportected device
Reset your device or do netinstall, take care of default security measures before throwing it to internet.