Well, odds are near 100% he used a gameshark or similar device. It's possible he owns a few of the distribution carts, but it's very unlikely he'd go to that much effort, and not all of them where distributed that way. If he used a cheating device, all those Pokemon are worthless because they aren't legit anyway. I would personally STRONGLY advise your friend against it, unless he is selling them for a fair price and he just wants the game itself. Besides, the fun of Pokemon is catching 'em all yourself. Last year I played through every generation on proper hardware and caught them all myself outside of a few events I went to Reddit to trade for, and it was a grand old few months.