Seriously, since when do we have to investigate the past of our coins/money? Should I buy a dog and hire a dog trainer to check absolutely every banknote that I receive, whether does it has traces of cocaine or not? Since when did that become my duty or anyone's duty? That makes no sense. When I receive cash, that cash can be used by top criminals but does that mean that if there is a trace of their fingerprint on my cash it should get confiscated, I should be left without money and face a jail? C'mon guys.
To be honest, paid blockchain analyses have serious problems too and they don't function properly. And I bet none crypto related company will ban you if you receive coins from someone who has mixed it or has done some small shit, even if that's the case. By the way, if you type wallet address on Blockchain.com, you'll see that some of them are tagged with a name, i.e. wallet X belongs to Mt. Gox.
The solution to your friend's problem is not to start attempting to investigate specific UTXOs before he has even bought them. The solution is to identify why he wants to do this and which services he is using which are placing artificial and arbitrary restrictions on his coins, and find and use alternatives instead. Alternatively, everything he buys P2P goes straight in to Whirlpool or JoinMarket to completely obfuscate its history.
This is actually the best response here!