I can’t fault a low-level employee too much for enthusiastically defending their company. I can’t expect someone at that level to know about sound development practices.

What’s often lacking though is a clear path for reporting security issues to people such as this representative. They don’t have a process to flag something for the security team.