You didn’t address any of his points and your rebuttals come across as little more than frantic handwaving. Moreover, as has been pointed in this post, VLAs don’t necessarily need to have security implications since they can be implemented outside the stack. Yet you keep bringing up Google and KSPP as if they are arbiters of truth instead of corporate entities with their own agendas.

You are also spreading misinformation. VLAs being optional does not mean they have been removed from the standard as you keep claiming.