He did not ask for money? Why on Earth? Dear fellow developers, know your importance and always ask for the work you have done.
What he could have done on the other hand is: inform the client of the attack and propose him to get rid of it for a certain fee...
Not a good general/continuing policy, but maybe worth doing the first time, if you're interested.
The moment he discovered an attacker he should have been on the phone with the client explaining the situation and asking how to proceed. If the client wanted him to shut down and clean up the hack, he should be charging for that. If not, he should have done nothing.
Transparency resolves most problems.