Exodus Desktop exports three extended public keys as far as I know. The first
xpub belongs to your Legacy account at m/44'/0'/0', the second
zpub to your Native Segwit account at m/84'/0'/0' and the third and final
zpub to your Taproot account at m/86'/0'/0'.
Depending on which of these extended keys your customer used, your bitcoin may be at "different locations" in your wallet. For more information about this, see this guide on derivation paths. No reason to worry, if your customer did indeed correctly use one of your extended public keys, you will be able to recover everything.
If the customer used the first
xpub, his wallet probably derived Legacy addresses from it. You should be able to see balance on those addresses in Exodus after you enabled advanced wallet mode in the settings and toggled Legacy Address on the right when viewing your bitcoin balance.
They probably didn't use the second
zpub, since that most likely wouldn't have caused any issues.
If they used the third
zpub things may get a little more complicated. It's quite unlikely that the wallet software of your customer used this key to derive Taproot addresses and the bitcoin would now be sitting on Native Segwit addresses, but using the wrong path at m/86'/0'/0'.
The latter and other similar scenarios (such as Legacy addresses on m/84'/0'/0' or Native Segwit addresses on m/44'/0'/0') can be recovered by manually deriving to the "wrong" path using the according script type. This can be easily done with Sparrow Wallet by disabling validate derivations in the settings, choosing the script type and changing the derivation path manually. Please only use these obscure accounts for recovery and not for actual usage in the future.
There is of course also the possibility that the customer scammed/tricked you into using an address that doesn't even belong to you. I just wanted to mention this but you probably know the circumstances better than I do.
I would generally recommend not to use extended public keys like this and instead always generate addresses yourself. That way you can verify the correct script type/path is used and verify the address belongs to you in the first place. There is also a privacy concern involved when you reveal your extended public key, since anyone knowing it can derive all addresses of the account in question, thus being able to see your total balance and transactions.