Who gets to play the role of expert? Presumably the "leaders in this language community" who "have given [everyone] lies and fear", according to Isaac's referenced blog post.

In the absence of a true quantitative engineering method, there is a middle ground other than personal choice: common anecdotes. Presumably, those shameful leaders have heard enough stories about the issue to make a reasonable recommendation, sort of like advising against shipping server software with an open default security strategy even though I don't have any peer-reviewed studies saying such is unwise.