This seems worse than tup, which I use for several projects and can wholeheartedly recommend. fac appears to only support Linux, while tup supports Mac & Windows as well. tup is scriptable in Lua and fac requires writing an ad-hoc script to generate .fac files. From their comparison page the only point in fac’s favor that I see is that you don’t have to explicitly list inputs and outputs for each command, and I don’t buy the “using FUSE is a security risk” argument.
Regarding fuse, I don’t think the point is that it’s a security risk, but that a security feature of the nfs infrastructure makes the fuse strategy unworkable.
A bit more info: He’s clearly at a university, and they use nfs, and the common way to export to users in this situation is to enable the root_squash flag. What this does is that it forces all calls that are sent as uid=0 to get mapped to some less-privileged user on the nfs server to avoid a variety of attacks (e.g. nobody). So he’s saying that tup’s fuse process will result in a write from root to his nfs home and that’ll get squashed into user “nobody” or “nobody4” or something else, and that user won’t have access to his files.