The argument in that article is that it doesn't matter what is in the source. The published package has no guarantees to be from the source.