A company that catches a spy does have better security than one that has not caught any spies.

He may be a spy, but he’s not a competent spy. Absence of evidence (of spies) is not evidence of absence (of spies). He just set the bar so low that even OpenAI noticed his activities.