A bit more practical advice: presuming that the screening process for the App Store isn't deeply, deeply, deeply flawed, there is very little concern for malware infected apps.
What could potentially be of concern is sensitive information being intercepted over a non-password protected Internet connection. Assuming your friend is concerned about his credit card being stolen rather than about the black helicopters coming to get him, just remind him to save online shopping for when he's on his home network (whenever possible), to use strong passwords (and not the same ones for everything), and to check his credit report regularly. Even if he doesn't own a smartphone, his bank and credit info will have exposure to the Internet in some way. So, really,during a Luddite isn't the answer. Best bet is to be reasonably vigilant while still enjoying the benefits of modern technology.
