Hey hey! This is a great question and something that's always a pain to deal with. They'll use a scanner like Qualys or Nessus, shit out a report, and be like "OH OH OH YOU GOTTA FIX THIS!" when it isn't inherently an issue.
So, specifically with IKE, I'd recommend swapping to IKEv2 with a PSK. You could setup a CA and do all the certificate stuff, but the value that you'd get would be incredibly minimal compared to the hassle. An upgrade to IKEv2 should be pretty easy and simple. Just use a unique 32 character or more PSK.
As far as the realistic risk goes, it's pretty minimal. Referencing a site-to-site VPN setup within, say, a Fortinet environment with FortiGates, you'd have the initial phase 1 tunnel created using that IKE negotiation. Make sure you use something like DH (Diffie-Hellman) 14, AES256 and SHA512 or at least SHA256 for the hashing and encryption. This connection generally only works because you're telling the firewalls who to talk to and who to expect traffic from. Attacking that portion of the VPN would be pretty difficult and a successful attack would mean you've got much bigger fish to fry.
Once the phase 1 tunnel is up, they'll do the phase 2 tunnel, which is what routes the traffic. An attacker would also have to know the LAN subnets on either end, which wouldn't be impossible, but still difficult.
Having the authentication is great, but it is mainly a security control to prevent unauthorized access after the tunnels have been established. If a threat actor did manage to be in the middle of that VPN connection, then it would disrupt them for sure. But in order for them to get there, they'd have to move mountains and there are much, much easier ways to get inside of a network, like phishing, spear phishing, or whaling that would be significantly more effective and cheaper.
tl;dr the risk is practically nothing. I'd still upgrade to IKEv2 with a strong PSK just to say that you have that specific protocol in place, but not doing so won't destroy his security posture. I think that's an acceptable risk for the organization to take on.
Also, I know nothing about this business, of course, so if he's in a regulated industry, it might change things a bit, but the reality doesn't change.
