You can and should use only a static site if it is enough, or use a static site generator. Why? Maintainability. Code has bugs. Every few weeks there is another WordPress security hole found. If you use a common CMS, you will have to patch it constantly. Else your friends website will soon contain advertisement for illegal drugs, ISIS propaganda, malware which is installed on visitors computers or worse. Even if you regularly patch it, you might be too late so you have to constantly check for hacks. There are ways to secure this CMS. Install "security plugins", configure a web application firewall like mod_security etc. All just more work. They also have to be kept updated. Sometimes your mod_security rules will break a plugin for WordPress, you have to analyze that and fix it. More work.
You might think, nobody will want to hack that site. But for the common security holes found in common CMS systems, there are soon automatic bots that crawl/search the web and hack ALL sites using that CMS. They just want to spread their links/malware/propaganda.
With a static site (created manually or with a generator), you don't have that problem.
If you implement your own backend, it will also have security holes (no one is perfect) but most likely no one will exploit them for that little website. But what do you want to implement? If you want to create an editor where your friend can change tour dates himself, think how long this will take you until it is easy enough for him to use without your help. How many times can you just quickly change the dates for him with that time budget?
In my opinion, far too many people today just use CMS systems for every site, because static HTML is "old". If you don't need anything that isn't possible with HTML5, use server side code. But if you don't need it, you save lots of lots of time without it.