Yes, there's always a risk of getting caught even though it's a common practice in places like Canada, US, UK and Australia. The reason why your friend has not been caught is most probably because he gets the wages for extra 20 hours that he works by cash rather than cheque or transfer. And the employer does not show a record of him of working more than 20 hours.
But, there's always a risk of getting caught because if someone finds out and they complain to CBSA, there could be a raid or an inspection at the work premises, not only the person will be deported to home country but the employer could be jailed or fined too.