Show it. Pick a missed edge case or breaking point in his app and demonstrate the pain the customer is going to encounter. You don't have to live in the realm of hypotheticals. He has given you a concrete, but flawed, implementation that offers proof of your message.
You are convincing me of it too. It is clear that your friend still needs your system thinking to point out edge cases and whatnot, but if you applied that by spending a couple of days adding a test suite to provide the missing validation, it seems like together you could have a pretty robust product built in less than a week. What justifies a couple of months?
