Sorry Op, I did not actually understand the story fully.
According to the story above, Alex is only in contact stage with the alleged or to-be partners. What really happened, did he disclose his private details at the course of the meeting?
Could it be that they hosted the meeting with tools like TeamViewer and he gave them unrestricted access to his computer?
I'm to believe that Alex the victim with his 150 wallets was all hot wallet (as Op may say) to store the tokens and same device that those Wallets were installed should be the same device Alex used to join the online communication (interview) with the scammers on their legitimate disguise.
So Imo, he was sent malicious link to connect/join the interview with the scammers with same device that holds the wallets therefore is the medium that gave the scammers access to the wallets of target.
So if Alex had used external device that's not connected to the device where the wallets where installed, I don't think he'd had fallen the victim and that's why Op suggested a hardware wallets or he'd had just have a confidential (separate) device to install those Wallets and never associate it with the internet to enhance security and stay off online threats.