I wonder why he was allowed to install and setup his private iCloud access on a corporate laptop? And if that somehow is allowed, then that machine should not have access to the IP of the company.

This is normal corporate practices since the 90s, and if you want to protect your information, you need to follow it. From a Dev / Sysadmin side it can suck having IT dictate whats allowed to be installed, but those practices are there for a reason.

At what point do you just not hire Chinese nationals (aka, those who maintain current Chinese citizenship.)?

It's unfortunate that China just doesn't give a crap about IP rights.