Perhaps he's saying: Microsoft didn't find a threat model. The VLC developers had the same conclusion.

So the issue should still be closed according to the supplied information in the bug post submission.