I wrote a longer reply here: https://news.ycombinator.com/item?id=47638062
It's not a XOR
If the claim was instead just "a good portion of the hundreds more potential bugs it found might be false positives", then sure.
Please explain how a bug can both be unvalidated, and also have undergone a three month process to determine it is a false positive?