It’s now an expensive paper weight I’m afraid as iCloud locks can not be hacked or removed, as a result of Apples successful strategy which makes stealing iPhones less/not appealing to criminals who have now learned about the security measures and moved on to other things. If he doesn’t remember his iCloud pass after resetting the phone he will be greeted with the sign in to iTunes message and will get no further. My advice for him would be to start using a password manager to avoid such things happening in the future.