I think s/he's saying that current security only protects us from script kiddies; so whatever we do only 'protects' data from them but data cannot be protected against state-sponsored attacks (but gives people a false sense of security)?

Altho' I don't quite agree with some of the implied premise, because it's not as if script kiddies can/would take data away (making it unavailable). But the false sense of security is relevant.