I want to know how they got access to his phone. Did he hand it over willingly? Did they run some kind of scan by connecting it to a device? Did they have a court order or authority to search it?
How do we help others avoid this sort of thing? My recommendation: start using Signal.
It was there since a long time. People coming to US are warned by foreign organizations about the port checking the contents of their phone, text, photos, apps etc. It just didn't happen as often as it does now.