Activation Lock is a theft deterrent, and a lock that was easily bypassed would not be a deterrent.
You will need the Apple ID and password (the message shows a hint about the Apple ID), or the original purchase receipt and matching photo ID and a discussion directly with Apple, or court paperwork in the case of a deceased family member.
Or in this case, your friend can log into iCloud using their Apple ID credentials, and can release this lock remotely.
Per Apple If you're using iCloud and Find My [device] on the device, sign in to iCloud.com/find or the Find My app on another device, select the device, and click Erase. After the device has been erased, click Remove from Account.
More info, should your friend need help recovering the Apple ID and password::
Activation Lock for iPhone, iPad, and iPod touch - Apple Support
If you forgot your Apple ID password - Apple Support
If you forgot your Apple ID - Apple Support
Recover your Apple ID when you can’t reset your password - Apple Support
If you don't have the above info, you’ll want to recycle this device.