It sounds like he needs an OS built on "default deny" principles. The best one for that is OpenBSD, and he recommends porting over three or four packages from OpenBSD. Really, he'd be happier running that, I think. I know I was when I first started exploring the BSDs. I tried FreeBSD, PC-BSD, and DragonflyBSD before settling on OpenBSD.
Default deny makes the most sense if you are interested in security. Sure, it can be a PITA to set up .conf files at first and get the packages you need, but once past the learning curve, it's the simplest thing to maintain.
FreeBSD reminds me a lot of various flavors of Linux I've tried in the (distant) past. All kinds of stuff running by default, old packages for compatibility, etc.
Security may not be important for many people till it's too late, but it's one of those things that pays dividends in what doesn't happen. Hard to sell if you've never been pwned.