Security is never perfect. It is a deterrent, not impenetrable prevention. So sure, to security people, it is never good enough. To everyone else, a easy to digest blog post might give them food for thought that would make their work one step better than it was before, resulting in security that is still flawed, but better. So why not just accept the post for what it is - some basic advice to do that one better step.
Do you honestly feel that the work of beginning web developers falls into the same risk management quadrant as a major governmental database of personal information?
Security is never perfect, and to security people, we know that there is a tradeoff between Security and Users.
We don't advocate letting The Perfect be the Enemy of the Good when it comes to security, and on the same token we want you to implement security properly if you do it.
Since the security advice in the article is bad, this is more the case of the wildly incorrect is the enemy of the reader who takes the advice. Somewhat different.
