I’d still agree with his statement. Subset of people who could even make the determination in available source code is small compared to total users, now reduce that set to people competent in reverse engineering. “pretty hard” is not a bad description imo