The worst case scenario is if Bitcoin Core simply nulled (innitialized) corrupt wallet.dat (previously wallet.(timestamp).bak file) then renamed it to __db.80000002.2d624f7d which is deleted afterwards.
Bitcoin Core itself is not doing what you suggest but it is possible that BerkleyDB is doing something strange in this situation (the __db files are below the level of what is coded in Bitcoin Core so if there is some issue with that then it is an issue with BerkleyDB).
Remember it was *you* (or *him*) that got rid of the file "wallet.XXX.bak" (by renaming it) not Bitcoin Core. What should have been done was to create a copy of this file (rather than rename it) in the very first place.
Also why on earth someone would be silly enough to rename such an important file as "wallet.dat" when Bitcoin Core is running is beyond me (it's as though the OP was trying to destroy his wallet on purpose which is hardly the approach that anyone who valued 200+ BTC would take).