That's a straw man, as that isn't what tptacek is saying. He is obviously talking about parallels in the causes of security incidents. That the consequences are different, and arguably incomparable, is irrelevant to the correctness of his observation.