He is right imo. How can each user's activity be tracked. Eventually something gets past the security.

What he is saying is that preventing criminal behavior will hurt their revenue, so they will let it happen anyway.

Much as I hate to say it, he isn't wrong. If users can write data, have it persisted, and read it back, you have gadgets for criminal activity. Period. No way around it.