Agree about multi signature

You’re right: he can do all of the above

Edit: If you only have one wallet then multi signature is the best option