Yeah. What they really mean is "we talked to a clueless drone in our IT department, who had a personal incentive not to find any exposure, and that person couldn't think of a way to exploit it in 15 seconds".

If you actually know what you're talking about, you basically never feel safe enough to categorically say that something can't be exploited.