The corollary to that is the first thing such people/scripts do when they have access to your account is disable Billing Alarms.
Root credentials are deprecated, but can still be used and if this guy used them then yes, his billing alarms could have been disabled.
There's a difference between an admin iam user (can't do billing stuff) and the root credentials (just as powerful as username / password).