After re-reading through your postings a few times, it seems there's an issue involving some mixing of definitions and semantics involved that are making the initial problem more complicated.
-- There's a password issue involving his Google account, something that based on his Gmail address and password. It will relate directly to his online Google account so it has a very high priority status. It's also most likely what he used to authenticate his phone. It will involve things like online syncing with Google services and Play Store account access but it's not SIM locking.
-- There's a lock screen issue, that relates only to his phone. It's a security and privacy measure that keeps others from easily accessing the contents of his phone. Some apps, like banking apps, will rely upon the lock screen (i.e. fingerprint, pass code, etc.) to work. But the lock screen applies to the phone itself, it's not going to apply to his authenticating himself to his online services, nor is it used as a SIM locking service.
-- There's a SIM-based PUK issue, might have been the original issue to address. The Personal Unlock Key is typically a passcode. It relates only to SIM access.
https://www.wikihow.com/Determine-Your-Mobile-PUK-Code
The three are not inter-related, they each apply to different aspects.