There is no settlement involved, because there is no legal claim, technically. None of the logic around legal settlements comes into play at all, so the devil's advocacy here is misguided. The NDA
is outlandish and is clearly designed to shut him up and cover up the mishandling of the case.
This might be different under UK law, but if he had sued you might have a point. Then I'd expect gag, non-disparagement, forefeiture of claims and so on. I've signed those personally and understand that. But if I haven't sued you and you gag me for what I deem fair? Well, sounds like I should potentially sue because someone is not operating in good faith, and it ain't me. That move alone would make me want to discover your internal communications about handling me and in this case, I bet they're awesome.
Keep in mind they're writing him off from saying "they fixed this! They're the good guys!" which sure, seems unlikely, but if a company takes care of something without a lawsuit a gag seems counterintuitive and in bad faith.