If you don't know that something can break, it's hard to get it right. But I have many colleagues who've never exploited a buffer overflow, but who still do a fine job of counting their bytes. High code quality and coding patterns that reduce mistakes are really important; knowing a little about exploitation is useful to judge impact and to design anti-exploit defenses, but don't overestimate the impact - defenders' time is often better spent elsewhere. (Of course, hacking is sexy.)

(I write high-security software. )

He doesn't disagree with you; he's a professional pentester.