I'm sorry, but if the ledger wallet was actually compromised it would be an extremely sophisticated zero day hack that the hackers would not compromise being exposed over a few hundred thousand.

The fact he saved a screenshot on his iPhone of either passphrase, which is number one do not, shows he wasn't being careful and likely made other mistakes that could have been exploited.

I do feel for your nephew, but it's almost certainly user error and not related to the ledger wallet at all.