Ian McKenzie comments on Password-locked models: a stress case for capabilities evaluation