There's absolutely nothing in the above comment that indicates the person you're replying to doesn't know the prevalence of XSS vulnerabilities.