Just to be clear, this is an argument that even formal methods might not be sufficient to secure Ethereum (and certainly not if applied piecemeal), not an argument that it can be secured by other means.