There is no harm in changing your password.
My recommendation is you do so without following any links in the e-mail you received.
If you don’t have and use a password manager I strongly recommend you start.
I use 1Password as a password manager, which allows me to have different strong passwords for every site. where I maintain an account. 1Password makes it very easy to retrieve my passwords to log in and I only need to memorize one password to access hundreds of strong passwords to my other accounts.
On iOS Apple makes is super easy for anyone with your 6 digit unlock code to change your AppleID password. Iforgot .apple.com will let you recover your account quickly if you have a way to receive the 2FA code and still have a valid credit card on file with Apple.
Otherwise, you need to use the Apple Account Recovery System. It took me 32 days to get back into my AppleID account after a catastrophic loss due to a robbery.
I would also recommend having a number of verified phone numbers where you can receive the Apple 2FA code. Don’t rely on just phones in your possession to receive the code. Add a relative or friend’s phone number not living in your household.
They will never get the 2FA code unless you tell ifogot.apple.com to use that emergency number to send the code. But you cannot add new phone numbers unless you can get into your account.
So do it before you need it.