This is one of the fallacies I see often. Take it from one of the brightest minds you can find on these forums (he is rather harsh here, but he was irritated from having to talk to intellectually challenged ):
Proof? Evidence?
Anybody can blow any nonsense words out their arse. Cryptographers understand that until you do cryptanalysis, you don't fucking know.
You're correct insofar as XC is not complete and expert consultations and public testing (for a big bounty) have not yet commenced. This, along with our making the code public, will "bulletproof" XC.
But I think what was meant is that anyone who's tested the mixer so far has failed to probably break XC's anonymity.
(Subsequently, XC's got trustless mixing, and further features are being implemented too which compound privacy and security.)