> To be blunt i would trust an engineer making a system that said there was a security concern in a system over a security engineer.
That depends quite a bit on what was being discussed. If it's the engineer's work specifically, and what they did and why, that's one thing. If it's an engineer making claims about specific encryption algorithms that they chose to use or not use in the software they wrote which is contradicted by a security professional, you should probably trust he security professional.
This seems to me a case of the latter. A software engineer making claims about things that are not their subject of authority, or at least not what they were hired for, and thus have less reason to be listened to about by their employer.