Aren't both these things true? - he says it shouldn't be used in prod - he acknowledges there are potential security flaws that should be revisited before 1.0

Aren't both these things true? - he says it shouldn't be used in prod - he acknowledges there are potential security flaws that should be revisited before 1.0 (https://github.com/ziglang/zig/pull/4929 https://github.com/ziglang/zig/pull/4929) I just feel like there is a lot of hair splitting here.