Even if your friend uses a $1000 offline wallet, it won't protect him at all if he gives away his private key while chatting. Though I doubt he's that stupid.
There are countless discussions about this already. You can search using the search form or Google it.
Possibly that could happen, when I was still starting here I used to put my private keys and other important stuff in my messenger
That's a recipe for disaster. Facebook might even use it and then said your account was hacked when they're the ones who steal it.