If he’s a professional security analyst, his findings would be compiled into a report. Demonstration of where code is in the binary, even network sniffing results - something. An article saying “this guy said so and he knows what he’s talking about” is literally crazy.