Could he have put any malware on it.
Yes.
I believe you are laboring under a number of misconceptions. If you have reason to believe your Mac was physically accessed and used by someone with malicious intent, the only correct way to recover from that intrusion is to completely erase the Mac.
Erase your Mac and reset it to factory settings - Apple Support
Follow those instructions. Change all passwords you may have been using with that Mac. You should also assume the criminal (so emphasized because unauthorized use of a computer is considered a criminal act in most jurisdictions) committed other nefarious acts such as modifying your network equipment, assuming it was also within physical reach of such tampering. Installing monitoring devices i.e. "bugs" or covert listening or viewing equipment is also not out of the question for someone you characterized as a "creep" skilled in such matters.
Installing non-Apple "anti-virus" garbage and putting the firewall back on are utterly ineffective and meaningless gestures that will accomplish exactly nothing and / or increase your Mac's exposure to threats.