TBH his statement doesn't seem that unreasonable -- he's basically stating that the attacker already had all the knowledge necessary to be "credible" and no different than a normal client.

Eg if the attacker already has your phone, email and password, its not really the bank's fault for giving away your financial details -- the game was lost before it even reached the bank.