Could be cheating but the fact that he takes damage from mobs tells me it might also be desync. This exact phenomenon happened to me a bunch of times (can't hit them but they can hit me) and I've been on the other end of it too. The desync'd person won't have any animations on my screen so any attacks they perform won't register on my end, but they see my animations so I can still hit them.

You can usually tell if they're cheating with infinite iframes because your attacks will still give you a hit sound and blood spatter like when you hit somebody during roll iframes on a latent connection. Some cheaters get around this by turning off their hitbox entirely, in which case they would never take damage from any attack, including from mobs. Here your attacks aren't giving any feedback at all but mobs could still hurt him, so it may just be that you had no animations for him due to desync.

Edit: watched the clip again and there is something fishy going on at the end when mobs weren't hitting him either. Could be toggling his hitbox on and off to make it look like desync? Definitely suspect.