Well, if you will put complete remote control of all your devices behind a single, weak password.....
Assuming the answer is no, there are only two remaining alternatives: 1) Someone targeted and keylogged him to obtain the password, in which case it doesn't matter how strong the password is; or 2) Someone hacked iCloud itself and stole their (presumably unsalted) password file.
In that case, yeah, a stronger password might've helped. Bad user. No cookie.
But if he thinks he's having a rough night, consider what scenario #2 would mean to Apple. The impact of an iCloud hack would be measured in multiple billions of dollars of market capitalization.
There's another possibility: he re-used his iCloud password on another account, that was compromised, and someone tried that successfully against his iCloud account.
The bigger issue, as someone else has said, is putting so much remote control behind a single point of security.
Typing-the-most-common-passwords-with-numbers through the interface style. Basically guessing from the top password list.
The possibility is a bit far-fetched, but it exists. The likelihood that this was actually the case is extremely low.
From the post:
> My password was a 7 digit alphanumeric that I didn’t use elsewhere.*
It sucks, but when you've got control of someone's iCloud account (email, and remote wipe of presumably their primary devices), you've put them in a tight spot. One of the many reasons that I use iCloud for my phone and iPad, but certainly not my primary machines (or email).
Rough night.