there is a 99% chance that this is a human error that led to leakage of password or private keys or seed and then loss of funds.
This is just the perfect explanation on what could have happened because by default, the software gives you the option of creating a password before proceeding to launching and even ask you for passwords before showing any sensitive information or transferring fund out of the wallet. If you then choose to ignore the opportunity to keep you safe at the minimum, then its your fault entirely and no one else. I am happy for him that he didn't lose more than that amount because the same reception of not upgrading and being out of date would still be the same and there is nothing anybody would be able to do about it.