Did he leave the keys in it? 2007.5-2013 GMT-900 trucks with PASSKey III (transponder in the key) are not easy to steal/hotwire without the correct transponder key...
2014/2015+ K2XX trucks/SUV's are incredibly hard to steal. Im not going to say impossible, but they have steering wheel locks (finally), the door handles are reinforced, and the doors themselves have metal plates in them and shielded lock push-rods to prevent punching out the lock cylinder or using a slim-jim. Even then if you were to break a window, the immobilizer system is very complex. Environment identifiers such as VIN coding, how long since the modules' last had power cut to them (ie, if the battery cable was cut or disconnected), and other information is stored in MANY different modules throughout the truck. The onstar module is really hard to get to, and has an internal battery backup.
GM doesnt even say which modules store environment identifiers and they dont even fully explain the details of the immobilizer system in the service manual, to make it harder for thieves to reverse-engineer the system. So basically, ECM/TCM/radio/instrument cluster, BCM (and more) modules all have to have matching VIN's, and have to have been powered up and plugged in for at least X minutes/hours before the ECM will pass anti-theft and allow the truck to start.
Not only that, even if you swap ECM's for one that has been tuned to delete VATS, the BCM will see that the ECM VATS is disabled (or rather, it will see that the ECM isnt doing the password challenge/response with the BCM) and then not send the "crank request" data message when the key is turned to "start". And if you replace/swap the BCM and ECM at the same time, you have to throw away all the keys and order new keys (they are side-cut like european cars) from GM....
