I want to know how they got access to his phone. Did he hand it over willingly? Did they run some kind of scan by connecting it to a device? Did they have a court order or authority to search it?
How do we help others avoid this sort of thing? My recommendation: start using Signal.
I quit most algorithm based social media.