Skyway
At the very least your cousin absolutely should wipe their phone and do a fresh install of the OS. If cousin chooses to stay with Stock Android then they should do a fresh install and NOT restore from a backup. Additionally, cousin should consider using a fresh Google account after installing Stock Android.
Speak with cousin about their "digital habits." If they regularly post anything to any social medias, they should cease doing so.
Teach cousin about phishing and make certain that they are not clicking on random links which might be emailed or texted to them.
Cousin should be taught how to use a password manager. Encourage them to change passwords on any crucial accounts, ones such as social medias/email/banking.
Your cousin will benefit more from behavioral corrections such as these than they will from installing GOS. If cousin installs GOS but fails to take corrective action in these areas they quite probably will end up back at square one.