Not everyone who buys a bike is a competent mechanic. If you bought a new car would you check every nut and bolt before you drove it? The shop has a duty of care to provide the bike in safe and usable condition, that’s the purpose of a pre delivery check. If they’ve neglected to do this then they are at fault, but your mate will have a tough time proving it, as they would be admitting liability. If their workshop is run correctly they should be able to trace who did the PDC and see the checklist. If the QR was tightened by hand and not cammed over then I think it’s possible the wheel could have come out when cornering causing the damage to the dropout which, in turn, could’ve caused the QR to contact the disc.
ETA Can’t see the pics, so judgment reserved.