Do you need to erase info in Icloud after phone stolen?

Access to his iCloud would require knowing his AppleID password. So there should be no worries there. If the device had a 6 digit screen lock passcode, that means someone has to get lucky and guess it right in 8 attempts before it will be disabled (and there are 1 million possible 6 digit codes he could have used).

If it is offline, it is entirely possible that someone has already erased it in iTunes, which breaks Find My remote tracking. However, as long as that phone is listed under his AppleID trusted devices, then activation lock will prevent anyone from activating and using it.