The article implied he wasn't the only one they talked with. There isn't anything he said that was explicitly incorrect (unlike some of the other unnamed security researchers), but he must not have much experience with credential stuffing incidents given his responses.