And I'm sure these "free" programs, with all their vulnerabilities, have resulted in quite a few dollars in "consulting" fees which he and his "not-for-profit" (=pay no taxes) organization (ISC) has billed for "support" over the years.
Of course, there's nothing wrong with getting paid for your work. It's when you produce bug-ridden programs that are intended for widespread public use and then claim they are the "gold standard" that you may face criticism.
And now he's in the "security" industry. It is indeed comical.