It is presumptuous for an outsider to use it. I don't think I'd say it to someone who had a Purple Heart (unless I knew them quite well), but that's not because I think the phrase itself is necessarily insulting. It's because the phrase is too glib; the fact of making a joke out of someone else's trauma is (potentially) far more insulting than anything the joke itself might contain.

Had the unnamed objector to this phrase specified that the joke shouldn't come from civilians, I'd give that view far more credence than what I understood her to say, which is that the joke is insulting and shouldn't be used, period.