One possibility is that he has the privacy turned to "Everyone" only at the User Profile, but not at Activities. Another possibility is that although he enabled the visibility to Activities to Everyone, he did the activites within one of his Privacy Zones - it then overrides all other settings, and such activities remain hidden anyway.
