This is just drama. The tweet thread he's responding to acknowledges the cri-o vulnerability half an hour before he responded.