But with respect you can't ignore the issue of the BT engineer who came round and did all these works and then said there were other issues when it was an auth problem all along. This just causes even more problems! Unless there was some other hidden issue with the line but I am not aware of this and the connection was fine, physically, before and after.
Well to fill in some blanks... When an Openreach engineer receives an SFI2 task from a service provider his remit is basically to ensure the line is firstly performing within its specs and then to get the router to sync up (green sync light) - authentication issues are not within his remit, if the correct username/password are provided by the service provider he can try to input these but if not or they are incorrect there is no obligation in fact I can say had on heart that I have never been given these details by TalkTalk in the job notes. While there is the provision for an engineer to setup or repair a routers setup this is often NOT authorised by the service provider (SP/CP's are charged for any completed SFI2 modules which includes end-user equipment).
Part of the SFI2 task can include testing the end-users (your friends) internal wiring/extension socket past the main linebox and there is a requirement to get the service working as fast and error free as possible, this can include replacing or fixing internal wiring, but again this has nothing to do with authentication issues and everything to do with complying with the mandate of the task outlined by his customer 'TalkTalk'.
When the engineer stated "there were other issues" he wasn't lying or wrong, indeed there were other issues stopping your friend getting online, issues it would seem the service provider had not empowered him to fix.