This guy is in the security business. If you think your software is secure, he's out of work. If he creates the impression that he didn't even have to try that

This guy is in the security business. If you think your software is secure, he's out of work. If he creates the impression that he didn't even have to try that hard to find these vulnerabilities, then you get paranoid and want to hire him. To be clear, I'm not saying the vulnerabilities weren't real, but to buy his story about them being "easy" to find, well...