I think he was very clear that his approach had nothing to do with the security of the actual code.

Yes, and nobody is disputing that.