To me it seems that these 2 options are the most likely ones:

1)
There is a weird and really rare bug inside of the coinbase wallet application which derived the one single address wrong only that one time.
While this definitely is not impossible, it is rather rare.

2)
Your friend has the wrong mnemonic code.
This happens more often than you would assume. People tend to "know for sure" which mnemonic code they have used. But in the end it always was their mistake (wrong wallet file, different mnemonic code, used a BIP39 passphrase, etc...).