Does he have leads on who's the potential culprit with the said hack? if it's a direct access then that only means that there's someone from his home that have done it.
There are no assumptions. Direct interference is almost 100% excluded: no one had access to his PC and there are no people around him who understand cryptocurrencies. The only thing I can assume is that the seed phrase was stolen during the installation of the wallet by some type of Trojan or the version of the wallet was compromised. Plus he used a Mac.
Whether someone uses mac or windows or linux, if the person have fallen to the phishing links or forms then the seed probably have been taken and compromised and the hacker just waited for it to get funded and always checks it from time to time. What an unfortunate scene for the guy, I just hope that he'll recover from this incident and won't make him quit the market because that frustration will make someone quit if it's a lot of money that's been hacked or even the hack itself alone.