It's a true statement that he is facing an uphill battle. However, it's heartening to hear that he's making the move because he's been doing this job already for the last couple months - just as a individual contractor on loan to the government. The fact that he's willing to keep doing the admittedly difficult but critically important work of securing White House IT speaks volumes.
It's clear that people like David are needed inside the government and you've identified the key issue - how can you retain talent in an organization that moves slower and more cautiously (and yes, sometimes a bit obtusely[0])? That's in my opinion, the beauty of USDS, 18F, the other healthcare.gov tech surge spinoff companies[1] - by concentrating enough technical talent in one place, you give everyone a place to talk shop, share strategies, and yes, vent frustrations.
USDS and others are not guaranteed success - by no means. However, they have a minuscule but non-zero chance and a little hope goes a long way. I look forward to cheering for each tiny little win they get, no matter how trivial (for instance WhiteHouse.gov is now https[2]). I want the government to do big things and watching it do simple things is the first step on a long long journey.
[0] Though most of the time, there is some rationality to how decisions get made - just sometimes not the rationale you were hoping for. Often it's because it doesn't exactly match a checkbox on a security checklist and you have to explain to them how SSH keys are pretty much like 2048 character long passwords.
[1] p.s. I hear they are all hiring. https://www.whitehouse.gov/digital/united-states-digital-ser... https://18f.gsa.gov/ http://www.va.gov/ds/ http://adhocteam.us/
[2] Just as of a couple weeks ago, it was http only with https erroring with domain mismatch to an akamai cert. It now gets an A on ssllabs.com.