The context in which that statement was made, and in which I’m repeating it, I think, is just to say that any bug has the potential to be used maliciously. Ignore it, fine, but also don’t overreact to the intended message…
It is mostly meaningless and tautological claim: even every non-buggy feature of a software system has the potential to be used maliciously; a working system itself too.
Yes, maliciously used features should sometimes drive change (eg. in how to reduce or reduce impact of social engineering attacks), but as a claim it has no value.
Phrased this way, nothing changes: both true and irrelevant. In other words, any action taken in response to this message is an overreaction. It's just noise.
Yes, maliciously used features should sometimes drive change (eg. in how to reduce or reduce impact of social engineering attacks), but as a claim it has no value.