Good point, but I read "engineering doesn't matter" to mean you shouldn't spend a significant amount of time carefully designing a system that's likely to change. pg is absolutely correct in that sense.

My point was the amount of time required to prevent security holes like the ones outlined in the link are minimal - preventing them isn't going to stand in the way of an engineer implementing other features.