If he owns the equipment and runs the service, he could put his business at risk, yeah.

If he leases the hardware to a third individual and that third person/organization runs an exit node, then he is at a safe harbor.

I have experience running Tor nodes and can help if he is interested.