Yeah... from personal experience, if an app is intentionally or unintentionally built without XSS or CSRF protection, a complete fix-up of a codebase as large as Basecamp is pretty expensive. Granted there are solutions that take care of 99% of the vulnerabilities, but the amount of testing/debugging/coding to close that 1% gap is huge.
Especially when you're still required to churn out new features in parallel.
I think most of us are missing the point. The author is not implying that he discovered a "hack" or "secret code", it's that Google consciously chooses to not match advertisements to text such as this. You can rephrase the sentences all you'd like, and Google will still not render ads.