My Office 2002 started to "crumble" and things quit working a couple of years ago - running on WinXP Pro. Microsoft ceased checking compatibility of WinXP patches with it, and some features sort of "quit working." Office 2007 was the only thing I could get then.
Lin has (had?) Office 2003 (on WinXP Pro) on her desktop up to last week when her computer took a dive. It was working quite satisfactorily, although she/we consider Power Point sort of a satanic curse that destroys productivity and prevents meaningful communication so we never used it much. (The Pentagon shares our opinion, and has banned it, so "military intelligence" isn't a total non-sequitor.)
If the computer was getting automatic updates, via Microsoft Update on a validated WinXP license, and the Office version was present on the machine, it should be up to date with respect to any Office security patches that are applicable. It has been possible to get only Windows Update that might have omitted Office patches(?).
The only "optional updates" that might be wanted are almost entirely "flow-down" things that are needed for "compatibility with Office 2007" and should be available without a new "license validation" on the Office version on the machine. Most of the useful "Office optionals" can be downloaded in installable form and shared with friends without worrying about whether they are "legal."
Lin is currently using our Vista Home Premium laptop with Office 2007 while her desktop is "in rehab." While it's no surprise that she's been cursing at the same "features" in both Vista and Office 2007 that have annoyed me for about a year, I'm a bit surprised that she knows all of the same curses I've been using. (She hasn't - yet - attempted any really professional level work in Office 2007.)
If your friend has NOT USED an earlier version of an Office application, it might be just as well to migrate to Office 2007 before learning how to do something that was easy in the older version but will be impossible in the new Office. If he doesn't learn any of the advanced features that have been obscured, he won't miss them, so he'll be much happier with Office 2007 when/if he does make the migration.
So far as we've seen, with Office 2003 there's no immediate need for "moving up" to Office 2007; but if it's a reasonable option now it would be okay, and just as well to do so before starting to learn a new ap.
If acquiring a new Office 2007, be very careful to check the exact version being purchased. There are a number of different packages, containing strange and illogical combinations of the individual applications, and it takes some reading-of-the-fine print to be sure that you get a version that has all of the aps you may want with a minimum of $uperflou$ ones.
(And note that some of the retail - FRP - Office 2007 packages permit you to install from one set of disks on a desktop and an "associated laptop" without buying separately for each. I'm not sure whether that's true for all the packages.)