He did not set up 2FA willingly. It is now required for all new Apple accounts.
He tried to find a way to disable it, but it is no longer possible.
If Apple had a 2FA method where he could use another email, that would have solved the problem. Or even using an app like Authy or Google Authenticator.
He is overseas, with no global roaming, and so is unable to receive calls or texts.
He took his phone because he planned on getting a local SIM card.