The whole post reads like an attempt by some security consultancy to capitalize on a currently high-profile issue by writing an "analysis" based on looking at the source code for 10-15 minutes and picking out a few arbitrary things to write a blog post about.