I agree with you. Even though I don’t want to speculate. But, it’s most likely the case that his application was parked this long for security reasons. But you know, IRCC sometimes parks cases for other issues. I know a guy that his application was parked for a year. When he applied for GCMS, he got to understand that his employment letter was not in the right format, and the officers had been trying to verify some details but unable to. After that he got new employment letters and submitted via webform. He received PPR 10 days after submitting the webform.