I suspect that either he's misremembering and he has used the password elsewhere (and it was compromised there -- easy to happen over so many years of use), or it wasn't very strong to begin with and it got guessed after a handful of attempts.
This may not be the case. Computers are very fast at checking passwords, and if Apple doesn't deliberately slow the login process for all authentication scenarios it is easy to check a lot of passwords in parallel.
This may not be the case. Computers are very fast at checking passwords, and if Apple doesn't deliberately slow the login process for all authentication scenarios it is easy to check a lot of passwords in parallel.