It was either bad opsec or he just didnt care for at least 4 years. His real name is all over the place:
https://github.com/ds300/derivablejs/issues/69#issuecomment-318461100
The article was written in a quite sinister way. But everyone knows now, and it's not a big deal. I personally want to engage with nostr a bit more now that it's less of a cult of personality.