The loss is three months of salary and the cost of hiring a replacement. Taken en masse, especially for smaller firms, quite a debilitating sum.

Is he actually doing the work? Is just copying code from OSS projects and does not actually understand it? Not only will this cause legal liability, but when the team is under stress will he just disappear or be able to solve an issue?

He already lied once. Why not lie more?

Lying is already rampant on both sides of the hiring process, and expected. The high stakes and algorithmic nature of (tech) hiring is the real problem - the rewards are great and the exploits are obvious.