Did scammers get into my friends entire apple ID account?

Entirely possible with just the password of the Apple ID. Just like your Social Security number or Banking information, this should not be given out and unfortunately too many people think they need to provide it in a response to an email or message. Review this support article and never give it to anyone. Changing it frequently would have also prevented the scenario from going on for 5 years.

Recognize and avoid phishing messages, phony support calls, and other scams - Apple Support

There answer to your questions is a definitive YES. If someone obtains or guesses your Apple ID password or any other non-Apple accounts (like credit cards) you can be compromised in any way you can think of. That is why it so imperative that users...

1. Use complicated, multiple character passwords that are not easily guessed.
2. NEVER EVER use the same password twice.
3. Change your important account passwords on a regular schedule (like very 60 days)
4. Don’t fall for scams or phishing attempts. If it looks too good to be true then it is definitely scam.
5. Pay attention to emails from legitimate sources, like AT&T who recently announced a data breach affecting 73 millions current and former users. Follow the instructions provided.

When is the last time your friend changed their Apple ID password?

Your friend should look at this article:

If you think your Apple ID has been compromised - Apple Support