GPS receiver (farka type) is pretty cheap of ebay.
He doesn't have a security code for it, the reason the seller doesn't need one is because the car recognises the HU 'belongs' to that car. As soon as you put it in a different car it will ask for the code. It can be obtained but its another hassle. Easiest thing would be for the seller to ask the dealer for it using his VIN number.
I have one of those, it looks prettyer than the RCD300 and the sound quality is much much better but if you want to navigate and listen to music other than the radio you will need a CD changer or Ipod dock. I would agree that a tom tom is a much better sat nav device but it does the job.