Which makes it weirder, in a way. Surely such a security guru is going to be tweaking his personal browser, especially JS and Flash settings, and probably finding himself locked out of something for not looking enough like a typical clueless netizen. Or, he knows better than most how sophisticated and adaptive lucrative botnets are, so why would he think JS and Flash are deep magic the bots can't do?

But, as others have noted, it's probably been boiled down into something dumb for the layperson, and their algorithms are more complex than you would think from that quote.

Edit: Actually, given their target users, I guess he wouldn't be locked out, just falsely identified as a fake ad consumer.