I'm not saying its easy, I'm saying a developer using the tools and processes available at a large internet corporation building something small need not be insecure. Basically until we look at the code and the security processes in place, or do pentesting, we have no clue one way or the other. I'm mostly just saying we shouldn't discount something like this automatically as insecure. It might be terrible, it might be very well thought out and have security be one of the most important considerations that was top of mind when he coded it.