You are looking at it from the wrong legal end. It isn't a question of whether the company can withhold future pay. The legal question is whether or not your friend is entitled to keep any mistaken overpayment, and your friend's legal obligation to return any unlawfully obtained financial benefit. The law doesn't just say, "well, the company made a mistake, I guess there is nothing that can be done".
The law views the overpayment as an "unentitled benefit" or "unlawfully obtained benefit". If the company finds out about the mistake, and asks for the return of the overpayment, your friend is obligated to return it. If your friend refuses, the company could claim the funds as stolen (since your friend is not entitled to them, and refuses to return them).