It's a tough one, he has bitten someone - and that needs to be addressed. However his bite was a reaction to something that was being done to him. Children with ASD don't have the social etiquette and reactions that neurotypical children do, and his reaction is, if you look at it from his point of view, quite reasonable.
Speaking from experience, lunchtimes are particularly hard for children with ASD. It's unstructured time with less supervision. My DS1 used to lash out terribly during lunchtimes and it was agreed that he needed a safe quiet place to go where there was less sensory overload.
I would advise that your friend speak with the SENCO at the school, enquire about things like "social stories" and "comic strip communication" which are ways of explaining the "right" way to react to situations like that. They are also helpful to gain insight into why the child has reacted the way they have.
Punishment needs to be immediate and apt. I don't think that this was the case here, but the school do also have a duty of care to the other children around - and a responsibility to ensure that they don't get bitten. However, your friends son has a right to not be touched, pulled, or made uncomfortable too.
The school need to put measures in place, with your friend's help - to prevent this happening in the future. Needs sorting now while he's young, before it spirals - because that's not fair on him or on his classmates.