I'm pretty sure

that the point he was trying to make was "here's this security critical 9-line patch, which is
entirely dependent on these other patches, which are in turn heavily dependent on these other
patches, and by the time you get back to the major release, you're at 800kloc."

Whether that's a reasonable approach to take is open to question.

But it's at least not blue sky.