Please point me where you found "Exposing the private key" phrase, I can't see it.
his claim is that since the public key is a curve25519 hash of the private key that it is exposed.
Yes exactly. You guess the private key "since it was created by a human", then you crack the account. That is why there are so many Nxt accounts that get cracked. You don't even need to do the cracking against the network, you just do it against the public block chain.
If the developers don't think this is fundamentally broken, then I really question their judgement.
There are 100000NXT on account id 100000; it doesn't even have public key in the blockchain (2^64 security instead of 2^256).
http://87.230.14.1/nxt/nxt.cgi?action=3000&acc=100000
Go, get it.