The paper acknowledges the problem in defining a security expert (see 5.1: Limitations)

Defining a security “expert” is challenging, and we settled upon a definition that is simple (5+ self-reported years of experience in the area)