I think what he's trying to say is that a random user can compile the program and say "Hey, i added X feature to bitcoin, try it!".

While in fact it had code that copies wallet.dat and send it to a remote server for someone else's use or directly sending the coins to a 'new' address.