Wrong. The LeastAuthority report reported "reentrancy hazards":
the refund callback could make a new donation, triggering another refund cycle, potentially double-refunding the earlier contributions, or failing to refund later ones
It is usually possible to protect against these hazards with careful state management
The object-capability community addresses this class of hazards by using the "eventual-send" operation whenever possible
They described exactly the problem which affected The DAO, and how to avoid it, and how to make language/VM resistant to such errors.