Your anecdote does not make GP's comment "patently untrue". It's just a counter-example, and we don't know how prevalent your scenario is compared to GP's.

(And I agree with the GP. I'm fairly cynical about most developers' security stance and threat model. Source: my own usage patterns.)