Not even just at-will. There's so many vectors to justify the termination.
Employers can terminate you for refusing to be vaccinated, or failing to provide proof. Superior to someone's privacy is the employer's obligation to provide a safe work environment for employees. So long as the virus is accepted by the government as real, the employee will have a very steep uphill battle to prove that the requirement was unnecessary.
Further, it would be a legal problem if the employer mandates vaccination for some employees but not all.
Moreover, there's likely language in the employment contract that would further bind the contractor to avoid any action (or inaction) that would reasonably risk damage to the company. Check the termination, duties, and indemnity sections, off the top of my head.
Either way, if the guy does software, he won't be out of work long.
Worst thing he can do is brand his own ass by filing a lawsuit where the public record will forever know him as an antivaxxer.