https://en.wikipedia.org/wiki/Peiter_Zatko
So I think that's a great example of how someone with a music degree could potentially be one of the world's top infosec experts. (Also I believe Chris Palmer, who used to be my boss and currently works on the Google Chrome security team, has a degree in linguistics but would probably have been rather tempted by a music degree considering his huge passion for music performance.)
I think it's worth considering what really does make for good infosec qualifications, but it's easy to see that it's not necessarily a university degree. (Also considering how many leading infosec experts didn't finish university.)
It couldn't be more ignorant to think that a music degree suggests anything about someone's technical competence (other than maybe a weak positive signal of intellectual breadth). One expects that from media outlets but to see it crop up on HN was shocking. Among people who ought to know better, I can't imagine a stronger indicator of small-mindedness.