That's a straw man, as that isn't what tptacek is saying. He is obviously talking about parallels in the <i>causes</i> of security incidents. That the <i>consequences</i> are different, and arguably incomparable, is irrelevant to the correctness of his observation.