He is in lockdown mode now. He was paranoid before so now we stepping it up. If he didn't have 2fa and all the basic security set with face id etc he would have been taken for a ride by them.
Discussion
So there was an actual attempt to exfil data or do something malicious to the device via an app that he had installed? What app?