I wonder how they know it’s been there for at least five years?
I have a friend of mine who I now think is smarter and and smarter as time goes by. He has at least one computer that has NEVER been connected to a network. He calls it his baseline. And has saved his butt a couple of times after his other computers were infected by viruses.
Does your friend allow usb drives to be plugged into his non network machine??
If so, it may not be as safe as he thinks.