It seems they are confusing hackers with hacks. I've often found that hackers deliver better quality code than process hacks. It's probably going to be a hacker that finds out for you that you have an Xss problem that is exposing your clients information