You can actually add more than one number so he could have added a family members or friends number. He might also be able to use the recovery procedure from this link to regain access after a waiting period:
Or if Apple did not force 2FA on new accounts, then this also wouldn’t have happened.