In the scenario I described, equivalent action would be to set up a device policy for him that disables installing untrusted apps. You wouldn't even need to have bought him a new phone!