Basically it was the smart contract[1] that came with the NFT where the victim is essentially executing foreign code that gets granted access to their digital wallet. That's the reason the scammers were so insistent that he did it on his main wallet (i.e. where the funds were)

[1] Think of these as being similar to Word or Excel macros embedded in a document... nothing bad ever happened with them, did it? ;-)