Could a key derivation function be used to encrypt data with a weaker key?
Yes, with caveats.

Yes, because this is the entire stated point of password-based key derivation functions (e.g., PBKDF2 or scrypt). The caveat is that more iterations only get you so much; 100,000 iterations is only enough to increase "effective" entropy by a little over 16 bits ($100,000 \approx 2^{16}$) — to match a real 128-bit key, you'd need a password with 112 bits of entropy, which is an impractical 19-character alphanumeric password.

One approach without this caveat is to use a PBKDF to derive an actual encryption key from a key and password; this has the benefits of both systems. There's a real 128-bit (or 256-bit) secret that protects the data, which is typically invisible to a user, but you require a password to access and use that key.