Did your friend buy a new device, or does he root his phone on his own? Your "a few weeks ago" suggest the latter and if that's the case, I'm pretty sure your friend is aware of the risk. It's kinda wild if he roots his phone but doesn't know anything about something like this. Why did he root his phone? Knowing the reason can probably help him encourage him to unroot his phone if there is an alternative for his needs.
If your friend still wants to use a rooted device for whatever reason, telling him exclusively use his iOS for crypto activities is a good thing. I don't see the point of using two mobile devices anyway unless one of them is used for budget cold storage. Another alternative is to do a multi-boot on his Android device, although this is less secure and probably what I won't do if I have a spare device to use.
Either install some of the available unrooting software or do a factory reset. Google android unrooting software and you'll see what I'm talking about.
AFAIK a factory reset does not remove the root, it will just restore to a fresh install of the system without any modification to the binary partition. At the very least, that's what happen to my Magisk/SU rooted phone with a TWRP recovery. That being said, I'm no longer up to date with Android modification tools, I don't know if there is a new rooting method out there that uses the default factory reset on Android to uninstall their binary. If you're referring to a new method, would be cool if you can share some links here.
