I really hope he had full disk encryption and left it powered off. At least your data would be safe from prying eyes, even if the device itself is no longer safe to use. If not, then that is really terrible practice, particularly for a security researcher. Doesn't everyone know to keep mobile devices encrypted and turned off when not in use (e.g. airports, border crossings, hotel rooms, etcetera)?