Technically, he can run his app on his device.

technically, anyone can grab a copy of source, put their phone into developer mode and install the app too.

But- practically, it's hard.

You only get 4 application slots on devices in dev mode for example and I think they also expire.

I tried creating an internal app for my company and was gobsmacked that I didn't have any sane method to distribute it short of taking full ownership of everyones devices via MDM.

You are of course not allowed to publish "internal" apps to Testflight (or the App Store, but that's more obvious).