I think the author is just totally ignorant, there's a whole community of security companies and researchers who are scanning every single package as it's released and have been doing so for some time now. Some of the details like how long the cooldown should be for are certainly up in the air, but the numbers have reasoning behind them.