I think his point is that by doing this we are simply treating the symptom (breach in security), and not the cause (unsound security measures). It appears to me as "security theater" in every sense that I understand the phrase.
Although, of course, the police aren't the ones who would be patching up the security vulnerabilities anyway. So arresting unethical hackers and securing systems aren't mutually exclusive. What a country!
