Just comment -- I think your comment was fine.
I wouldn't bold the whole comment, since I wouldn't presume that my comment is the only one people should really be paying attention to. If the comment is good and the question is well-read then the comment will get upvotes (and in this case did). Upvoting is Stack Exchange's mechanism for highlighting whole comments. Not bold, not all caps, not loads of exclamation marks.
Don't scream and shout. Don't make it your life's work to persuade this person they are wrong. Don't even try to work out whether they really mean it, or if that's just a (very weird) stub implementation so that their program runs enough to demonstrate this issue that they're working on now.
For all you know (although it's unlikely), they have a unit test for that function, that is currently failing, and there is no danger at all. They can ask another question later how to implement AES (although that might well get closed too as a library request).
In fact in this case I personally probably wouldn't even comment. The code in question is so clearly not AES that I'd consider the function name to be the error. The author seems way out of their depth, and if they genuinely believe that to be an AES implementation then they're beyond my help. If you want to help them with AES then good luck to you, but that's nothing to do with the question asked :-)
It's very neighbourly of you to point out the issue, but you will kill yourself if you make it a goal to ensure all the code you see on SO is secure. Nobody is advising anybody else to use that code for any purpose: its security implications are pretty much moot. So you don't have to review question code except as it relates to the question.
I disagree with Johan's comment on the answer, "-1 because you cannot answer a question like this whilst leaving security issues unaddressed". I think you can do exactly that. Asking a question on Stack Overflow does not entitle the questioner to a free security audit (or any kind of free code review). It's legitimate merely to answer the question actually asked, if that's what you want to contribute.