Two points of opinion on this: 1) There is no true randomness 2) Absolute security is not necessary or useful #1, because of cause and effect, in other words

Two points of opinion on this: 1) There is no true randomness 2) Absolute security is not necessary or useful #1, because of cause and effect, in other words if you are an absolute observer who knows the state of all matter and energy and can retain infinite information of that knowledge then by knowing cause and effect of all things nothing is random to you. So in a true sense it isn't possible, so 'true random' is relative to the ability of the observer to measure cause and effect. #2, Because security is securitu of something against some other threat. Outside of theory, no one will face an absolute threat that threatens everything. A threat with finite ability to do harm intends to do harm against specific and measurable resources by abusing a finite number of vulnerabilities. Threat x Vulnerability = Risk of harm In reality, this equation applies on a finite but large number of threats and attack vectors. Where humans exists, Threat will always be greater than 0. In the article's context, they seek to reduce vulnerability to 0 so risk multiplies to 0 but even looking at only crypto vulns, a one way function with 0 vulns still needs a key to reverse it and management if that key will also need to have 0 risk, otherwise the net risk is still not zero. If AES is replaced by a new provably unbreakable cipher, what will meaninguly change about risk assesment? I think the premise is you somehow can stop worrying about some non-specific threats. But if you specify your threat, for example as 1 and your reduce your vuln to 0.000001 then your risk of 0.000001 is negligible. Absolute 0 is not useful other than to help you feel better.