I have so many questions.

You're probably right that he was tricked into opening a link containing malware that looked like a Teams link, but why did he keep so much money on a single online device? The moment my Crypto went over 20x reaching a total value of over $100k, I was investing some of that money into a new offline computer and a hardware wallet to store it all. Nowadays you can get a full security setup for around $1k and that includes a fireproof locker to store your backup, a backup hard drive that you can swap in case of a main device failure and a new clean notebook as your access point and main machine to use for payments.

He just needed to spend less than 1% of his funds on security and this would have been avoided.

Also, 150 wallets? Nobody can keep track of such number of shitcoins. There's no way he has a separate password for each of them.