I think the fact that he was not notified about this suspicious activity on linked account renders all this as Apple wrong doing. Doesn't matter whether Dash dev actually gave his phone to someone or actually was doing something fishy by himself, failing to notify account before closing it just doesn't seem fair to me.