If my outlets are GFCI protected, does that make a wet-location setup okay?

Your instinct is right. GFCI protection and placement rules are two seperate things, and one doesn't cover for the other. In the current code, receptacles aren't allowed within a certain horizontal distance of the tub or shower edge, measured on the wall. Your buddy is only half right, GFCI protects against shock, but the placement rule exists so you're not reaching for a plugged-in appliance while soaking wet and standing in a tub. Protection is the backstop, not permission to install anywhere you want. Here's why it probably passed: that rule hasn't been in the code forever. Older houses get judged against what was required when the work was done, or at the time of sale in some cases. If those outlets went in decades ago, they were legal at the time, and nobody makes you bring every old outlet up to the newest placement rules just because codes changed. That's called being grandfathered, and it's why inspections pass on plenty of stuff that a new installation couldn't do. That said, grandfathered isn't the same as a good idea. I ran into something similar with a bathroom outlet right by the tub in a place I bought, and I had it moved. An electrician can reroute it to the vanity area on the same circuit and GFCI, patch the wall, and you're done in half a day usually. Not a big job. So, is it a code problem you must fix? Probably not, legally. Is it something I'd spend a little money on? Yeah, I would. Hair dryers, curling irons, radios near a shower, that's a real combination even with GFCI. GFCI trips fast but it's not instant, and wet skin lowers your resistance a lot. Call an electrician, tell them the situation, and ask what it'd run to relocate those. You're not worrying over nothing, you're just a couple decades ahead of the house.

We had the same thing in our old house, except the outlets were over the tub. Electrician said the easiest fix was just capping them off and adding a new one by the vanity since the vanity alredy had one. Cost way less than I expected, like a morning's worth of work.

One thing I'd add, test those GFCIs every so often even before you decide what to do. They do wear out over the years, and one from an old install might trip on the test button but not actually cut power fast enough anymore. Mine looked fine and wasn't.

Grew up in houses where there wasn't even a GFCI in the bathroom, just plain old outlets right over the sink. Nobody thought twice about it back then. Makes me appreciate how far this stuff has come. One thing I'd check is the age of that GFCI unit itself. If it's the original one from the 70s or 80s, it may pass the button test but still not trip like it should on a real fault. Those older ones had more internal issues than the modern ones do. When we bought our place I had the electrician swap all the old GFCIs for new ones while he was there, cheap peace of mind. Curious what year the house is, since that'd tell you a lot about what rules it was built under.

Update: took another look tonight and checked the GFCI like someone suggested. No date on it but the face is yellowed and the buttons feel stiff, so I'm guessing it's original to the house. Also noticed the outlets by the shower don't get much use anyway. If an electrician caps those off like the person above described, does the GFCI feeding them just get pulled out too, or does it stay?