If the old device can still connect to the Internet then it should get informed of the password change. If not then he may need to use the old one.
Depending upon his security concern regarding the old phone, he can either do nothing or he can remotely erase it. If he thinks it is around his house then the concern is low. If he lost it out in public or it was stolen then read this support article about what to do if a iPhone or iPad is lost or stolen -->
https://support.apple.com/120837
- The Find My service described in the article is the only recovery feature Apple offers. It must be set up before the device is lost.
- “Don't remove the device from Find My, even if you remotely erase it. Removing the device from your Find My list removes Activation Lock, which will make it easier for the thief to unlock and resell your device.”
- Note that if you remotely erase your device as instructed in the above article, if you subsequently remove it from your account as in this article --> https://support.apple.com/HT205064 , then according to this article --> https://support.apple.com/HT201441 you remove activation lock from the device. Do not remove it from your account. If you do that then a finder or thief will have an unlocked device that can be used by another person.
- If a thief tricks you into “signing in” on a fake Apple site and you later receive a removal notification from Apple, read this entire thread: https://discussions.apple.com/thread/256374216?sortBy=oldest_first
and https://support.apple.com/guide/icloud/remove-a-device-mmfc0eeddd/icloud Unfortunately if you have fallen victim to this there is no solution to recover your device or to prevent it from being reset by a thief.