They didn't say there are holes in Flask, but that the Flask version of an app is more likely to contain holes (presumably because you're less pushed into safe defaults).