He seems very impressed with the privacy: "In fact, nobody knows that he got it except me and him", "nobody can ... look at your account balance".

But every transaction is public. Is there anything stopping the NSA (or Amazon, or me) from subscribing and adding up his current balance? Sure, it'll be linked to his bitcoin address, not his name, but that can't be all that hard to map, can it?