>has basically zero options with which to pursue his interests in a controlled environment

No way, he could easily get his own lab in AWS and probably for not much cost since he is in Uni. Hell, buying used stuff from ebay or some other auction site and hacking those for legitimate research would also be a path. Medical devices are probably low effort, high reward.

I definitely get where he's coming from with not having peers interested in security. Message boards and chats only do so much, but there's ample knowledge out there to build a plan for how you want your life to go from this upbringing. Going to a few conventions (even alone) would probably do wonders for him in terms of making connections but those can be expensive.