What a horrible mindset. I'll never understand this "security" argument.
Removing features is not the most secure option possible. Go all the way then and remove everything. Only when your computer cannot do anything it will be 100% secure.
Just annoys me that he calls features "crap" just because he likely doesn't use them personally and ends that post with a random sentence claiming such a version "increases the risk of drive-by attacks" with zero evidence.
The developer explains the features aren't plugins and aren't even enabled by default.
Arrogance from maintainers like this from within Debian is what will hurt it far more than any external entity.