Iranian law makes every child of an Iranian man an Iranian citizen irrespective of where he was born, so technically he probably is an Iranian citizen by birth. This isn't uncommon - e.g. my son is a Norwegian citizen as well as British because he was born in the UK but I'm Norwegian.

That said, I think it'd be immensely cruel not to recognize him as a US citizen, and he may well be right it might be unsafe for him to claim Iranian citizenship.