Simply what I wrote above: The fact that no observation counts as evidence against the claim, every possible observed behaviour can be explained by "it's magic". That includes the behaviour of all the components of the system, including the people. You claim that there are all those people and roles that make sure that crap doesn't go to production. I make the observation that those people and roles and whatnot have decided to implement a 5-char limit on passwords. You respond that "it's magic". No matter how obviously terrible the observable effects of the system are, you will find some rationalization why the black-box magic can exhibit this behaviour while also being perfectly secure.
In case you aren't aware, it's a term from epistemology/philosophy of science.