Your anecdote does not make GP's comment "patently untrue". It's just a counter-example, and we don't know how prevalent your scenario is compared to GP's.
(And I agree with the GP. I'm fairly cynical about most developers' security stance and threat model. Source: my own usage patterns.)
Why should they apologize? All they did was point out that you just provided a counter example, not statistics (thus "we don't know how prevalently your scenario is" yet), and share a personal opinion.
(And I agree with the GP. I'm fairly cynical about most developers' security stance and threat model. Source: my own usage patterns.)