She lost me on this particular quote:
>> I can explain that a hosted Javascript application is vulnerable to a deep structural attack better than any of them — I explain things for a living.
Doing something for a living doesn't necessarily imply that you're good at it.
Conversely, not doing something for a living (i.e., "explaining things") doesn't mean you're not good at it either.