I think what they meant was he transferred her funds using the app on her phone to a crypto wallet that he had on his own phone.
Coinbase has a security feature where any new destination addresses must be whitelisted which requires you to wait 48 hours before you can send
anything to that address. So if the victim had enabled that feature it would not be possible for him do anything with her funds.
Sometimes, it astonishes me how people treat their funds, even on custodial wallets and their gadgets.
I hope all the parties got their lessons and there will be one less possibility of such cases in the future to come, because it's abysmal to see the funds being drained in such a manner, basically because of the trust coming from nowhere.
It's scary to think how much of our life and even all of our assets can be accessed from our phones, tablets, laptops, etc.
That is why people should be hyper-vigilant, almost to the point of paranoia when it comes to their phone and device security.
So at minimum, enable every advanced security feature possible on your device.
It is well worth it to sacrifice a little convenience to gain a great amount of security.
You never know when your device will be lost, stolen or destroyed. It can happen in an instant.