Yea, he did. I think the point is more that MEGA can read the key, and your files without permission. This contradicts their claim "Your data is encrypted by you before upload to our system and therefore we do not and cannot access that content"
They can claim they won't, but can't is misleading to the point of fraud, in my opinion.