Yes, WEP is relatively easy to crack and can be done in a matter of minutes with the many free tools currently available. WEP also only protects the wireless traffic itself, so once someone has they key there is very little control over what they can access on the network from a standard access point.
If your friend is running a public internet access in a cafe then they should really invest in a proper hotspot solution that involves issuing prepaid tickets instead of using wireless encryption. Such solutions provide a method of controlling the speed, content, amount of data and time spent online and are generally much more secure than simply handing out a WEP key.
Some good software products exist that can do this such as m0n0wall
and MikroTik RouterOS
. These both need a separate computer to run on but when set up correctly do the job very well.
If they aren't up with the tech side of things, an example of a good hotspot solution provider is SurfSpot
. They actually supply a preconfigured wireless hotspot appliance and have an excellent billing and ticketing system. There are also many other companies like this around the world in case you don't live in NZ.
Some network vendors such as D-Link produce hotspot appliances as well, however many of them have known security vulnerabilities and should be avoided.