I concur wholeheartedly, although at this point civil liability should be the least of his concerns. Whether unknowingly (snort!) or not, he sold a dangerous defective item to the public, now that has come to light he has a statutory duty of care to fulfil unless he wants to open himself up for prosecution for criminal negligence. (Disclaimer: IANAL & I don't play one on TV either!). Ineffectual protestations that he's emailed everyone who he knows might have one of these telling them to destroy them and he'll issue a replacement aren't going to impress the judiciary.
Product recalls exist for a reason - so each and every dangerous unit can be accounted for. Samsung didn't WANT to issue a recall when their phone batteries started doing phosphorous grenade impressions. Tesco, Morrisons et al didn't WANT to plaster notices all over their stores admitting some of their steak might have a Grand National pedigree, they did so because it's the effing law to do so. The safety and well being of the general public comes first. Lame half measures like emailing your customers to burn the evidence if they have one is woefully insufficient, this doesn't account for any that may have been accidentally left in the back of a taxi, lost, stolen. sitting in the window of a local charity shop, people who use Spam trap email accounts when they buy online so may never even see said warning, people who for one reason or another may have switched ISPs and no longer even have access to the email account he has on record, etc etc. If you've sold a potential incendiary device, you do everything and anything you can to warn as many people as you can, customers or not.