I suspect the difference of opinion is because those two people are making very different assumptions. One comes across as too dismissive of security concerns,

I suspect the difference of opinion is because those two people are making very different assumptions. One comes across as too dismissive of security concerns, suggesting security is not their problem unless management is bothered. The other comes across as assuming most software is used in ways where security problems are a major risk. Neither is realistic. Combine that with an unnecessarily hostile tone and some ad hominem, and it's going to attract downvotes on a forum like HN where civil discussion and logical arguments are both usually appreciated.