Well his phone could indeed be 'hacked' but there's a good chance it's not the actual problem. It's unfortunately a too common occurrence, especially for Android, for any and all problems to be attributed to '...the phone has been hacked...' when there's a completely different issue involved.
In any case though, getting an accurate diagnosis is very unlikely to happen in an online help forum. Your, or rather his, best option is to take this phone into a trusted, local service center to have a trained person look things over. Someone in actual physical possession of the phone will be better able to make an actual summary than vague descriptions and random replies that you get here.
There are way too many variables involved -- the phone could be compromised in some way, or it could be just a matter of one or several of his online services that are in question, or a combination of both, and there are multiple levels of severity involved on top of that. Could be the Android operating system on his phone has been exploited in some way (...and to answer your question directly, both non-rooted and rooted phones can be compromised so that's not as relevant), could be an installed app that's the problem, could be one of his online services uses on his phone is the issue and not the phone itself. Could be this or that but finding and then fixing the actual source requires an involved, hands-on approach.