OP said the thief was using Jaxx wallet:
they put the receiver phone on the table ..their phone ...was a iphone with a jaxx live wallet
You say Jaxx doesn't show up unconfirmed transaction, but my (admittedly several years ago) experience with Jaxx is that it does. Certainly, their support pages suggest that unconfirmed transactions are displayed as "pending transactions":
https://support.decentral.ca/hc/en-us/articles/360048583473-Pending-Transaction