I believe that was more or less the point he was making - regardless of the language or platform developers without proper understand can and will make security mistakes.
Microsoft provides a lot of security features that are backed into asp.net that are pretty trivial to enable. From what, little, that I know about php I am not sure the same can be said. I believe that would make a bigger difference about perceived security of a platform