I assume by first sentence you mean the statement that "That is how we get software that is riddled with security issues" The argument is that you assume that

I assume by first sentence you mean the statement that "That is how we get software that is riddled with security issues" The argument is that you assume that the minimum value of code is zero, so that any code that ships has to be better than code that doesn't ship because at worst it is worthless, which is the same value as code that doesn't ship. My point is that bad code can be worth less than zero if it actively causes harm. So for example, code that has a critical security vulnerability which leaks personal information is worse than nothing. You would be better off not shipping anything at all than shipping something that causes actual harm.