It's funny how you apparently can "set new standards" by "using industry standard security processes".
But considering the security features that we include such as Same-Site Cookies, CSP using Nonces, etc. I don't think the statement is totally wrong – many products are sadly missing these. We also have a bug bounty program where we offer up to $5000 for qualifying vulnerabilities: https://hackerone.com/nextcloud