I disagree with Mullenweg for many reasons, first of all, he only focused on low type of security steps, secondly, he said the main risk to the hosting companies that scan your website to check for any malware issues.