So what law did they break? What do they risk? Should they hire a lawyer? Should they expect to spend time in prison?

If you are going to tell them to dismiss my legal advice, at least provide your own answer. I'd tell u/Badly_Concealed_Pun to ignore what you said, but you didn't actually say anything.

According to UK law, the crime is possession: https://www.legislation.gov.uk/ukpga/2008/4/section/63

We can also look at the jurisprudence. The court of appeal in the case of Cyprian Okoro ( https://www.bailii.org/ew/cases/EWCA/Crim/2018/1929.html ) said that "for an individual to have possession: (1) the images must have been within the appellant's custody or control, i.e. so that he was capable of accessing them; and (2) he must have known that he possessed an image or a group of images."

I'm not here to be judgmental. I am not going to tell op that what they did was stupid or that they did better friends. I'm here to talk about the law, and as a matter of law, op cannot be charged for possession of something they don't possess.