The Apple ID is the issue. If the machine was registered to an Apple ID, which is 99.9999999% certain, AND they have Find My Mac turned on and they have 2FA then it will not work without that PIN code. As mentioned elsewhere Apple's 2FA is horrible. I set it up a while ago but quickly turned it off as it was impossible to deal with on the Apple TV.
You can try making a bootable installer, erase the drive, install and you might be able to just skip the Apple ID part. Then the customer may be able to create a new Apple ID to use with that machine. I actually just checked mine and don't think there is a way to make iCloud "forget" that device. To properly deal with it they will need to gain access to that iCloud account as well as go to appleid.apple.com to turn off 2FA.
This is one thing I give Apple credit for. It's virtually erased the market for stolen Apple equipment.