The law that he broke was a section CA Penal Code 502, specifically that he disrupted or denied computer service to an authorized user and he did so without permission.
Refusing to provide a password is absolutely not a denial of service. That's like claiming losing keys to a rack in a data center is a denial of service.
However, he made one of the biggest mistakes then that he could have. While under police surveillance, he decided then to leave the state and make cash withdrawals of over $10,000. He was arrested, and that's where it became a criminal matter instead of simply an employment matter.
How this is a criminal act? Was he under court order to stay within the state of California and not touch his money? This whole case was never a criminal matter.