Azorult and hydra takes screenshots, so whenever you wrote those words down, they might have been snap shot and sent to hackers.
Hardware wallets generate the seed on the hardware wallet itself and display the words on the screen of the hardware wallet. Taking screenshots of your computer display is irrelevant when you use a hardware wallet as the seed never appears on the computer display.
bob123 is correct. The only way screen grabbers could have stolen his seed is if he manually entered it in to his computer, in which case there are 100 ways his seed could have been compromised.