Again NAL. But since it is known that you “friend” was aware of the glitch and intentionally acted in a way to get unfair benefit, the business can pursue legal action to recover damages.
Consider it like this, if a jewelery store forgets to lock their store at night, it does not mean you are free to walk in and pick stuff as you please.
I am not sure if there are precedents in India, but in western countries this case would normally go in the favor of business and your “friend” would be asked to pay for damages.
And yes, at any point the complainant and defendent can reach an out of court settlement and the case can be dropped/withdrawn without prejudice.