Agreed. This is a lie. Plain and simple. Even of you don't know any of the particulars about this issue, the post just contradicts itself. This is a textbook example of how not to own up to a security issue - if anything, this response makes the entire thing worse because you realise the actual problem (their approach) isn't being fixed, only this specific manifestation of the issue.