i think i understand now what he meant: "If that security assumption turns out to be inadequate, a lot of software will be broken". which is true. But yeah it's fud, imo

Many people have said that cold card mk4 with 72 bits was insufficient. (Other analysis suggests they may actually have less than 72 bits)