What can someone do with a stolen wallet for a few seconds?

In addition to the issue with your credit/debit cards, you may be subject to future targeted phishing or identity theft attacks, depending on what's in your wallet. Addresses, pictures, loyalty cards, personal information and such may be used against you to lower your security awareness and/or attempt guesses at passwords and "verification" questions.

Don't be so paranoid! An ill-wisher would just have pocketed your wallet. Somebody did you a good turn by handing it in to the desk, so that nobody else would be tempted. Be thankful and stop worrying!

Everything is risk vs reward.

You left your wallet on gym floor. A group of guys saw it and returned it to the front desk. I have two things to say - I managed a Golds Gym for a while and I also have worked out at a gym probably 200 days a year the past 25 years (started young).

Your example is super super frequent. It is also sometimes annoying I often would have my phone wallet keys and I am super setting, walk away for 1 min (like 20 feet away) and boom my stuff is in the front desk. There is almost zero chance - let's say .00001% that a group of guys would take your wallet, take any piece of info from it, and then return it to front desk in 30 secs. The gym would probably have them on camera. Unless these guys seemed EXTREMELY suspicious I would thank them (even though it is annoying) and move on with your life.

The other side of this is you cancel all of your cards and everything in your wallet, call up the card companies get new stuff, and then they send everything to you. There is a far far far greater chance than the .00001% that you are currently dealing with of someone getting to your new cards before they hit your house, activating, and using your cards than this good Samaritan at the gym.

So go ahead and fall for the fear tactics from some answers and put yourself more at risk.

Note: The real risk you run with your wallet laying on the floor at the gym is someone hitting it with a card reader. They might not even have to touch your wallet and there are ways it is done where you would have a hard time telling on camera.

Someone COULD have read data from your credit cards. Either superficially, by reading the numbers, or by scanning the magnetic strip or the chip.

As you immediately notified your bank, you won't directly lose money, even if the details should be used before the cancellation had got through the system.

You might have 'lost' personal information that would be useful in an identity theft.

You might have notified someone that a new credit card would soon be arriving in your post, also a separate letter with the new code. Post can be stolen.

Here is a minor addition to the other good answers, something that could happen but you probably don't have to worry about.

Here in the Netherlands, our debit cards support contactless payment which, up to a certain amount, doesn't require a PIN code. That amount used to be € 25, but they've increased it to € 50 because of the Covid-19 pandemic (as to reduce the number of times people have to touch the payment terminal). Wikipedia says the United Kingdom has this system too, but I don't know the limits; anyway, I imagine them to be rather low.

In theory, 30 seconds is enough to grab a few snacks or drinks from a vending machine in the same building, but the damage would be very limited in this case (not worth the hassle of replacing your card).

If the thief is prepared, they can easily get the info for each card in your wallet very quickly with a smartphone that has NFC, it would take someone less than 30 seconds to get the info of every card in your wallet.

That's if you have multiple cards in your wallet, if you have a single card the wallet doesn't need to be opened to get the info (which comes with the bonus of appearing to be innocent if the owner is nearby).

The above only applies for a targeted attack, plus if you have an RFID-blocking wallet this attack vector is defeated.

In reality, this comes down to how much you trust people, in my local community when someone loses a wallet, the people that find them will often post in local community groups on social media in an attempt to locate the owner, often with a (censored) photo of one of their cards or IDs that show their name.

If someone wanted your money, they would've just pocketed your wallet without handing it to anyone or saying anything.

It is fun to think about scenarios. These are extremely unlikely but possible.

1. A prepared thief could have replaced your credit cards with counterfeit cards. You probably called the number on the card to report it lost/stolen. The counterfeit cards have a number where the thief's confederate pretends to work for the credit card. He or she may fish for other useful information from you. You think your card is cancelled, but the thief is now busy using it.
2. Someone could slip a tracking device into your wallet. Maybe they have a listening device that they can sneak into your wallet. From now on they know where you are and can listen to your conversations.
3. Someone could have put an envelope of COVID-19 into your wallet. When you find it, you will get COVID-19.
4. Someone could have replaced your cash with counterfeit bills. They obtain the value of your cash and if you try to spend your money you may be subject to arrest.

Contactless card skimming is a thing. Your contactless card can be scanned using any NFC-capable device, such as a smartphone, and then the adversary can use that device to impersonate the card until the contactless limit is reached; usually around 10 transactions before the limit kicks in (the specific number is random each time), with a maximum £45 per transaction. After this, any further attempted transactions will require you to physically insert your card and enter your PIN to reset the limit.

Theoretically, the adversary could just wait for you to make a legitimate transaction and enter your PIN, allowing them to take more money from you, but someone would have noticed by that time: either you would have probably noticed the fraudulent activity by then (e.g. through bank alerts, checking your balance, or discovering that you're overdrawn and a payment won't go through), or your bank almost certainly will have (e.g. due to atypical spending activity and/or transactions occurring near in time but distant in location) and thus suspended your card and/or contacted you.