Now his wallet is
It's no longer "his wallet". It's a wallet on which both him and the hacker have full access and, obviously, the hacker has the skills and the tools to get the money faster than your friend can see them.
The only thing that could be done would be another bot/s on your friend side to move the coins, but it will just be a "battle" between the two bots with no guarantee at all on which one would win (of course, I don't know the particularities of that/those specific blockchain/s, so there's a chance I'm missing something).
So imho you should find a better use for that money of yours.
The hacker knew the private key of that address and therefore set up a fast bot to be able to withdraw any deposits to that address.
You need to deposit a small amount, for example $2, check the bot’s response time, and then program a bot to withdraw in a shorter time.
If the bot's response time is very short (a few seconds), then it will be a game of chance. Whoever has the fastest bot with the highest fees will get the airdrop.
I don't know the hacker's bot, nor the specifics of SOL, but can't it do a/another RBF with higher fee, leading to a "higher fee"
game war between the bots until the block is mined?