Technically, neither is wrong, although the second comma is oft utilized to prevent ambiguity. It has its stylistic use as well, but that’s generally a read-aloud thing, and has little purpose in such an argument.

As it is, people’ve been arguing over whether or not the comma should remain for many years; there’s no mistake, either way; modern usage suggests that there’s a trend towards fewer commas, so in actual practice, the Oxford comma should be reserved for situations when it is necessary.

It’s alright to use it for all scenarios, though, since it has few (if any) drawbacks when used. It helpfully removes ambiguity if other ‘and’s are in the vicinity… like if one were to say

“The three dishes we will have today are grilled eggplant, fish and chips and ham and cheese sandwich.”

Which doesn’t make much sense, admittedly, but illustrates the point: with the addition of the comma after “and”, one can remove the possibility of the person in question having a fish-and-chips-and-ham-and-cheese-sandwich.

However there’s another problem with this sentence in that you might want to associate ‘shirt and tie’ as a collective idea as in ‘fish and chips’, ‘bacon and eggs’. You can’t say ‘we had cereal, bacon, and eggs for breakfast’ if you want to keep ‘bacon and eggs’ as a phrase. Although it sounds a bit clumsier I think you would then say ‘we had cereal and bacon and eggs’. This looks even clumsier written with the two ‘ands’ so here it might be permissible to put a comma after cereal.

An example like ‘he bought a pencil, a shirt and a jacket’ would have been easier.

Use commas to separate three or more words, phrases, or clauses in a series.

A conjunction goes between the last two items of the series.

While some authorities say that the comma before the conjunction is optional, leaving it out may cause confusion, so it is better to include it.

Words: Use commas to separate three or more words, phrases, or clauses.

Phrases: This morning I woke up, got dressed, brushed my teeth, and ate breakfast.

Clauses: In fact, the bus was full of people who got dressed, who brushed their teeth, and who ate breakfast this morning.

Incorrect: The street was filled with angry protestors, shouting spectators and police.

(Leaving out the last comma makes it look like the police were shouting, too.)

Correct: The street was filled with angry protestors, shouting spectators, and police.

(Makes it clearer.)