It's explicitly stated that it will weaken the security model, but it's not explicitly stated that it will modify user.js. Now the author is claiming that reversing the change would be improper because it involves modifying user.js without explicitly saying so, but that's literally exactly what they did already.
They are not claiming that the problem is being forced to strengthen the security model without explicitly asking. They are claiming that the problem is specifically being forced to modify user.js without explicitly asking.
They are not claiming that the problem is being forced to strengthen the security model without explicitly asking. They are claiming that the problem is specifically being forced to modify user.js without explicitly asking.