IMO it’s sloppy, or at least a code smell, to be merging changes that still have comments like that into commercial software main branches to begin with. But it’s still not a security issue or anything like that.
The future engineer who picks up whatever ticket that’s referenced is going to have no idea that comment exists in that file unless it’s called out in the ticket anyway, or people just know to globally search for references to whatever ticket they picked up in a given day for some person’s old notes. At that point, just share a source code line link in the ticket to however many lines of code are relevant. Quite irritating to see an old comment in the code saying something like “TODO: Remove once PROJ-1234 is done” and PROJ-1234 was marked done three years ago. Does it still need to go? Why was it left in?
You think the Palantir CEO has a soul? You gaze into that orb once and it’s game over