There is a huge shortfall in cyber security worldwide. He might not be in the codespace but could be in other roles, its not like the only show in town is code. There's communications, training, analysis, data science, record keeping, LEA liaison, standards, compliance, you name it.

A degree is a 2-3 year commitment. Napier university in Edinburgh for instance.

A 48 yo has a life expectancy to 80 or better. There is another 20+ years of work life in him, if he wanted it.