I mean technically, maybe, but it's extremely unlikely that they'd sue without sending a C&D first. And given the lack of damage even if they did it'd likely get dismissed quickly with him just giving up the domain.
The biggest trouble people get themselves into with this kind of thing is if they, upon being contacted by the company, ask for money instead of immediately offering to transfer the domain to them free of charge. At that point it's trademark cybersquatting and they have your own words in the email as proof.
Speaking from personal experience here: being on the end of any kind of notice with the threat of legal force, even if it's not a lawsuit yet, is the kind of stress you just don't need in your life.
But... INAL and this is not legal advice.