We can't afford that level of benefit of the doubt for the people that are supposed to guard us from exactly this kind of bs.

Intent or not, that developer is a risk to the project.

Finally, a rational argument from the torch and pitchfork crowd. Xiao is not taking security sensitivities to heart : HTTP?? To China‽ and a dismissive BS answer.