Yes but why didn't ask for a video meeting (I know in hindsight is easy to say and that can be also spoofed, but less likely)
I assumed it was because he didn't want to bother the employer thus potentially loosing the job. That's why I say greed.
Yes, the speed of execution is key here.
Reminds me of that open source zip library hack, where the attacker/s went from commenting on posts to contributing pull requests to actually becoming the main person responsible for the repo.
