That would mean that the attacker can already predict /dev/urandom, rendering it effectively useless. So the parent is right, "the result will be as strong as the best source of entropy", if both sources are bad then the result will be as well.
It is true under the assumption that the two sources are independent of each other. If one of the sources is entirely known or predictable, this will not affect the entropy of the other source.
You have two adversaries. Adversary A have control over your hardware source, and adversary B have control over /dev/urandom. If you XOR them A and B must cooperate to compromise your random generator. You can combine as many sources of randomness as you want, and each increase the difficulty for an adversary to defeat your generator.