VAC is set in place to detect cheats, and doesn't take place instantly. Your buddy could've been already detected by VAC two weeks before he was even banned by VAC. Player reports have absolutely nothing to do with VAC bans. VAC bans show up on your account as well. If so your fault for letting him use detected cheats on your account.