"So what" is that if the disclosures are false, there is no cost other than potential reputation damage if the thing you blow the whistle about is unpopular. For this particular whistleblower on this particular issue (a highly respected and politically well-connected person talking about security and privacy), there is pretty much no chance that it costs him anything.

That means that being a whistleblower is strictly positive expected value in this case, which means that there is a heavy incentive to find something to blow the whistle about, no matter how flimsy. Additionally, the whistleblower has a strong incentive to add color about how bad these problems are.

People treat whistleblowers as unbiased sources of reliable information, but that could not be further from the truth. If you ask a tobacco salesman if their product has health consequences, they are going to say "no" (unless there is incontrovertible evidence of health consequences) the same way a whistleblower is going to say "this is super bad" about something that happens at a company (unless there is incontrovertible evidence that it was not bad). Understanding the bias of a source is very important.