Four clicks because as you said yourself you were trying it on fresh systems, where the login keychain (this is the one that by default security-dump dumps) is going to be pretty empty. It’s not a reasonable scenario if someone has only limited time for access.

You still didn’t explain what happened to your friend, and whether this is relevant to it.