The purpose of the deliberate errors is to avoid (or delay) having the discussion about the automation. He is not "on the hook" for fraud unless he acts like he's in a sit-com and blurts out that this has been going on for 6-months.
He could just say: "...hey, I've been working on automating this task, I think I got it working now."
If you're "not 'on the hook' for fraud" only because you haven't shared material facts ("this has been going on for 6-months"), you're committing fraud.
One is the deliberate insertion of errors. He should stop doing that. That's not cool. (I wouldn't label it as "fraud" though.) If the employer found out about that, they'd be well within their rights (legally, ethically, whatever) to fire him over that point alone. However, it doesn't sound like the intentional errors are any more than what would naturally occur if he hadn't automated the system, so the end result is unchanged, so while I won't give him a pass on it, I also can't demonize him for it.
The other is having built an automation tool without telling his employer, drastically reducing the amount of time it takes to do his work, and then not having other work to take on to fill his time.
To me, at the heart of it is whether he's being paid for his time, or if he's being paid to get a specific job done. It sounds like it's the latter (and I would say that's the case in any salaried position), so while the company might be annoyed/pissed that their estimate of the time needed was way off, that's really their problem, not the OP's.
We wouldn't be having the same discussion if he didn't automate, but just got more efficient at the job because he'd done it for a while. So say initially he had to work 40 hours a week to get it done, but after 6 months on the job he was able to drop that down to 35 hours a week due to familiarity with the work. Why is it ok to work 5 hours less but not 38 hours less, while still getting the same job done?
Fraud, though? No. The only way it would be actual fraud is if he were getting paid hourly, and he was marking up a time sheet with 40 hours when he really only works 1-2. But it doesn't sound like that's the case here.
I agree with you wholeheartedly on point #2 but am completely in disagreement over point #1. It's definitely fraud because he's manually inserting the errors specifically to deceive and give the illusion that he's doing something he's not. Whether the job is automated or not doesn't really matter. To your point, he could just have gotten so good that there aren't any errors anymore after 6 months and no one would bat an eye. To deliberately insert errors that don't exist simply so that he can give the appearance of not doing something is intentional fraud.
He has NO REQUIREMENT to volunteer so-called "material facts" unless he's in a courtroom.
They hired him to do a job. He's doing the job. But because of a lack of trust, he isn't telling them that a little devil in the form of a VBA macro is helping him immensely.
The more I think about it the more I align with the OP clamming up and enjoying the ride until he finds something better-- or perhaps until he develops enough trust to be able to reveal the automation.
The biggest hazard, aside from loose-lips, is that the company could hire a 22-year-old business analyst who might quickly report back that Excel can do a few more things than they thought. Then the 22-year-old will look like a genius and the OP will look like a blockhead.
He could just say: "...hey, I've been working on automating this task, I think I got it working now."