Can headphones transmit malware?

I doubt there is a way to store any information (thus transfer information) on regular headphones. Some more advanced models (such as noise canceling) have some processing ability and firmware, but I don't see it as a viable attack vector.

While I would not say "impossible", I can say that you don't need to worry.

Headphones do not have any storage that could be used to store malware. Also, they usually do not actively send much data to the phone they are plugged into that could be used. For example, only send sound data if there is a mic, and maybe some simple play/stop/skip/volumeup/down signals. However, they do not send complex commands like "install a driver" or some other more complicated commands that could have a bug which could be exploited.

Maybe one could create a fake headphone that exploits a bug that could somehow execute something on the device. However, that won't happen on the common headphones that you or you friend have, for sure. It could be possible especially when talking about USB or bluetooth headphones, since they use a more flexible communication channel, and it is harder, but not impossible, in common jack ones - e.g. take a look in these card readers - note that for that you would need a buggy software that expects other data in the sound jack, as a card reader software, pre installed to be exploited).

As mentioned in a comment to your question, the most important thing to do when borrowing a headphone may be "wipe the earbuds down with rubbing alcohol". Other than that, don´t worry!

Potentially, yes -- but it depends! Quite a number of Android devices (and potentially a lot of others) enable access on a serial UART console on the headphone jack during boot (a nice wrapup also exists on pentestpartners.com). You don't need a lot of electronics (and space requirements) to build a headphone that can (ab)use UART access to do something evil, from reading information to changing software.

If you're connecting headphones through USB (which will probably occur much more often with USB-C) or Apple's lightning connector, generally the same issues as with other USB devices apply -- especially if the device supports the USB host mode.

This does not fit your very special scenario where you borrow your own headphones. Somebody would have to modify the headphones and add up malicious electronics, and it does not seem your mistrust your friend to have applied something like this. But generally, headphones are a potential attack vector.