Yes I know but I reset my PlayStation password completely when I recovered my account. But through the whole process I was still signed into the app the entire time. So I'm assuming the person still has access to it? How do I get them off of it?

Login to Bungie.net website, then go to sett, then account/linking. At bottom, it should show which devices have used your account to login. Unlink any/all that don’t belong to you.

I ended up clicking to disable ALL mobile companion sessions. When I did that, it logged me out. But all I had to do to log back in was press one button. So did that actually do anything? Because what if they just have to press that one button.

Do you have your phone set to auto-login (or whatever the correct term is) on/with your phone? Did you make sure to change your psn password & enable 2fa on your account?

Yes I changed my password and enabled 2fa. I'm just concerned because even as I was doing that process and after, I was still logged onto the app. Only when I disabled all mobile companion sessions did it log me out, but even then, I didn't have to enter any information. Just pressed the button and it logged me in.