I often see comments like this on encryption related project. Depending on the reader you make what might be an essential point - but I also don't really know how useful it is to say it here. The author makes no claims about what adversaries this should be sufficient against and is completely open about their constraints and decisions (allowing you to make the critique in the first place).

Basically evading a state-level actor is going to be hard. People do get lucky but to evade them in a straight-up contest you need to very clever (if it's possible at all). Given that, I just dunno how useful it is to emblazen warnings on AES-based encryption schemes that it won't fool the NSA. Either the person reading it is not technically equipped to evaluate the claims and may be scared off of a solution that protects against some adversaries while searching for an impossible zero-config state-proof solution. Or the person already knew as soon as they saw 'AES' that this isn't the project they need.

I don't mean to denigrate the inclination to highlight weaknesses like this - good communication around this is genuinely challenging.

I'm generally pretty fatalistic about avoiding state-level adversaries. So, in a sense, it doesn't really matter how one thinks a security countermeasure is going to stack up against an IC attacker. The important thing is that people understand how hard this is to do, and take that into consideration before adopting tools like these. You can easily make things worse for yourself.

I think this post is a fun technical case study on its own. It only takes on urgency because it literally markets itself as a tool to slip past state adversaries. I think it's important that people understand that it isn't the state itself that's going to take the time to detect something like this; it's some commercial forensics vendor they use automatically.