The biggest red flag that makes me question the competence of the IOTA developer(s) is that they "removed a part of the copy protection mechanism which became useless once details of its work had become known to others". That sounds like they were relying on "security through obscurity". An absolute no-go. Another one is that they claim something is impossible in practice because it requires the user to be tricked into running arbitrary code... that happens all the time.