You did right to tell your little girl to Tell. It is not a secret to be kept when someone wants to touch her inside her underpants. Period.
Let Gramma know, let anyone know who watches her, that it happened. NO SECRETS. No overreacting, no making the kids feel weird. Just watchful adults, being mindful that she is FIVE & needs to be watched. The boy should know too, that people are aware, that's all.
Yes it is normal to explore at that age, but her body is private & should be kept that way.
The red flag is that he told her to keep it a secret.