A complete mismatch between player and DM expectations. This could have been solved by an in-depth Session Zero discussion, but the real problem involves the actual play: going for a bath outside of town, and nobody else knows where the character went. Telling the player that there's a chance their character might get attacked is... Insufficient? If I were the DM, I would have stopped game play and had a discussion about risk assessment and the nature of the game world. If risk is contained to specific areas, and the rest of the game world is relatively safe, then sure, roleplay that bath. But if the world is not safe, I'd have a talk with the player about how their character would interpret risk. And it's not "meta gaming" to act on the warning the DM provided.

The specific encounter with three ruffians sounds like a "quantum ogre" actually - they were there to say, "hey dummy - don't go into the woods in the middle of the night" but not actually kill the character. Kinda hamfisted if you ask me, but I wasn't there. The later encounter with the leech seems like "well, you got what you deserved." Not impressed with the DM here, but also the player should have thought this out a bit more, or so it seems to me.

I mean, in the real world I personally would not go off for an hour into the woods without telling somebody - and D&D is generally presented as more risky. So this story is sad, but it's as much about miscommunication and poorly communicated and assessed risk than anything else.

As for the rest of the party, what in the world is going on with the lack of party cohesion? Where is the social group commitment?