yeah, i would be more suspicious that he accepted a default setting provided at OOBE, and created a new icloud account, than some bug in the Activation Lock system. i haven't gone through the OOBE flow recently but it's super easy to overlook something like this.
he does question whether this might have happened:
> That the iCloud address starts with a “p”, my first initial, is haunting me. Could it be that I somehow created an iCloud address when first setting up the MacBook? I certainly don’t remember doing this though.
Or another scenario:
> If I hadn’t set up Find My for the MacBook, they should have been able to wipe it themselves. When they set it up for themselves, they could have set up Find My, and now the Activation Lock would be enabled.
Very, very plausible.
So in either of these cases, the system seems to be working as designed and they just got caught up in an edge case. The criticism of Find My seems appropriate ... the link to activation lock is definitely not well known. Just as macOS gives you an annoying notification about "take a tour" after a little while using it on a new install, it should give you an annoying notification that without Activation Lock someone with physical possession can make it theirs.
he does question whether this might have happened:
> That the iCloud address starts with a “p”, my first initial, is haunting me. Could it be that I somehow created an iCloud address when first setting up the MacBook? I certainly don’t remember doing this though.
Or another scenario:
> If I hadn’t set up Find My for the MacBook, they should have been able to wipe it themselves. When they set it up for themselves, they could have set up Find My, and now the Activation Lock would be enabled.
Very, very plausible.
So in either of these cases, the system seems to be working as designed and they just got caught up in an edge case. The criticism of Find My seems appropriate ... the link to activation lock is definitely not well known. Just as macOS gives you an annoying notification about "take a tour" after a little while using it on a new install, it should give you an annoying notification that without Activation Lock someone with physical possession can make it theirs.