You should have opted for a hardware wallet to store probably 90% of your coins and leave 10% on mm for quick access. Very horrible thing to happen to anyone, i can understand your pain.
Yes, he did realize it but it was too late. The hack already happened. Now he learned his lesson because he is now using a hardware wallet to store his remaining coins. A hardware wallet has a better security than common wallets however I think there's still a risk once we connect it online or by doing a transaction so it's still important to check properly before we initiate a transaction.
i don't understand why you did not get notification of confirmation when the transaction was being made, isn't mm usually send notification of confirmation when you initiate a transaction! at least that would have notify you of something shady going on in your wallet. I hope you will recover your loss in some other ways.
Yes, metamask always shows a notification if we will confirm the transaction or not but maybe he wasn't online that time and his account is already controlled by someone else so it's always possible for them to allow the transaction and send the coins to their own wallet. I check the hacker's wallet via etherscan and the OP's coins are still there. Maybe there are still ways to recover it? We can try reporting it to the authorities. Let see if they can do something.