There have been some changes in key positions within the Central Bank of Cyprus this year which have caused delays in the application review processes. I wouldn't worry too much about it. I'm already seeing improvements and things look promising going into 2021.
Buying a license has no advantage in terms of timing, since the regulator will review the new shareholders as an entirely new application. At most you save a couple of weeks of the review process, if the products and services remain the same. Generally speaking, it's only worth buying an EMI if you also need to buy the platform, product, and/or customers.
With Brexit, several jurisdictions like Ireland and Luxembourg are being overwhelmed with new applicants. Unless your client has strong connections to another EU member state, Cyprus is probably still the best option.