When I was running $1m+ through PayPal a year for my TV torrent site they always wanted a working username and password for the site because competitors would email them claiming we were actually selling CSAM behind our login. They wanted to know exactly what was going on behind the wall. They also did not care in the least it was a torrent site (!).

Given all the horror stories of locked PayPal accounts your friend would be well served too transfer money out of that account as frequently as possible.