He said it's overvalued, not that it's irrelevant.
In your example you expect the mechanic to lock your car and keep the keys safe, but you don't expect it to be put in a walled in area with armed guards and full-time surveillance.
The latter is what IT security can quickly lead to.
That's absolutely true, but the position he was endorsing was
>Meanwhile 4 put of 5 webshops we check have critical vulnerabilities and half the owners don’t care because “it just costs money to fix it and things have been fine so we’d rather spend more on Adwords”
Waiting until you get owned to actually patch up critical vulnerabilities in order to save money is negligence.
In your example you expect the mechanic to lock your car and keep the keys safe, but you don't expect it to be put in a walled in area with armed guards and full-time surveillance.
The latter is what IT security can quickly lead to.