"and were told by their employer that they did not have to pay federal, state or 10% penalty since the withdrawal was related to Coronavirus."

Well, that's sort of the tax rule. But not really.

They have up to three years to repay it to that account, and if they do so, they can amend any year(s) they reported and paid income tax on it, and it's as if the income never happened. Otherwise, if they keep it, it's taxable to the extent that any distribution from that sort of account is taxable (given no basis and not Roth 401(k), as examples).

Which is why their employer should not be doing tax returns.