A reasonable response to that would be to talk about:
what went wrong?
were there existing best practises being followed at the time this bug was introduced?
what can be improved?
is the mono-client environment that is widely promoted in Core a bad idea? how does this affect the narrative that people running old versions of node software should be supported?
They were urged to update recently by Core and Theymos How was it that a Bitcoin Unlimited developer from a smaller team find this but a Core developer from a bigger team containing
people who have spent more time working on the C++ codebase, didn't find it? Are their qualities, attributes and other experiences that the Bitcoin Unlimited devs have got that give
them some advantage? what exactly would have happened to the network if an attacker had found this bug? is there any possibility that this bug was no accident? is Core safe against the
injection of a similar bug in the future by an actual malicious developer? Notice that Greg Maxwell, Wladimir J. van der Laan, Pieter Wuille and Cory Fields didn't spot it."