"appear compromised" should be reserved to when multiple unrelated instances occur with no direct relation.

While you describe plenty of recent facts, from the "he has spent years earning it" I take the wallets were setup years ago and honestly, I would not trust even myself on operational security of a single device/passphrase that I may regularly use.

Are you really sure that a given iphone has never "left his possession"? Was it locked in a safe the entire time?