I imagined normally when you were to change password, all logins from all your devices with the username would auto signout forcing you to relogin with new password.
My desktop forced me to change password and i did but my mobile is still stayed logged on without the new password.
Is this not considered a security risk?

Not really. The purpose of this exercise is to avoid your account to be accessed by using known password from database breaches, ie new logins.

The forced password change only applies to those who have passwords which have been leaked from known data breaches.

Your login cookies will expire and you will still need to relogin with your new password.

i have been force logged out on mobile and desktop.
is my data has been leaked too?