In this case:
1)It's a customs violation - He has already shown a disregard for not just any, but the very rules you're being asked to be trusted to follow.
2)18 is still an adult - Adult rules apply and thus adult responsibilities and penalties. Also as someone posted in addition to a customs violation he violated min. age laws for alcohol.

If you take the example above of a security clearance - if you've previously violated a security clearance by sharing information, should you then be able to get one just because time has past? No, you shouldn't you've shown yourself to be unworthy of trust with the very thing you're about to be trusted to do.

CBP has a very high threshold for getting in. Which considering what you're getting in return is justified IMO. The risks of someone bringing something in illegally are there. It should only be given thus to those that have shown to have no issues following the rules.

An appeal will be pointless. CBP rules are clear - violations of customs rules/regulations in the US or any other country make you ineligible for GE. I wouldn't expect to get a job as a bank teller after a theft conviction. Likewise someone breaking customs rule/regulations shouldn't expect to get GE.