What's visible once you are past the hyped language in the article is that Patreon had a 5-person security team, and MULTIPLE security vendors up until this point?
Doesn't that look like too much for a small startup to start with? And if one argues that 'No amount of security is enough', then HOW many security vendors does anyone need?
Is there an objective measure? Like, does the amount of manpower that a security vendor should determine whether that vendor is enough? Or the number of industry-renowned personas that work in that vendor?
What happens if one player buys out all those security vendors and combines them into one single large vendor? Will that be enough?
...
So basically there is no objective criteria for this. The proposition is 'less security is bad', but nobody defines 'the right amount' of security objectively. So even if Patreon or anyone else is using a top-notch competent security vendor that handles all their stuff, it wouldn't be enough because... well, this is a chance to do some hype, obviously.
The proposition of the article in canceling Patreon and 'moving somewhere else' is also very dangerous and it feels like self serving.
Cancel Patreon and go where? Set up a subscription service yourself? And deal with all the chargebacks, fraud, refunds, financial compliance, and gasp sales tax collection and clearing? Or, one of the much smaller Patreon-competitors who have even less backing and organization behind them? So move from Patreon to... 'smaller Patreon'?
Which would easily put someone in hot water regarding actual legal responsibilities that can land one in large fines and even court sentences, by the way. People think that just because they have been making some side money here and there on the Internet and this was not something that the tax agencies and governments would bother to look into, things will stay the same if they start making such regular, noticeable income. It doesn't work like that. Things get serious.
Because now the money that you are making with your creative activity is not occasional 'gig money' that is paid you in cash somewhere, totally unaccountable. Its regular, trackable income that may land you in very hot water if you end up getting called up by your tax authority randomly in a few years. There is always the chance that your government may start a major sweep to weed out tax-dodgers so it may not be even random.
So such propositions like in the article 'Cancel and do something else' feels like random retorts from people who don't actually know what they are dealing with - laws and other people's money.
...
Even the prospect of having to set up and maintain a billing system should make people shudder at such a proposition. Its all fun and games at the start when you are setting up stuff. Not so much when keeping it updated and compliant takes a considerable chunk of time 2 years down the road. Forcing you to do deal with those instead of doing your creative activity.