‘You cannot use past returns to measure risk’ is a much-repeated adage in discussions about risk. As you very rarely get anyone arguing that you should, what is the need for the robust denial?

I blame education! In teaching the maths of risk management, students are often required to source historic series of stock returns and calculate risk metrics based on these past returns. Students are possibly less focussed on the caveats to the lecture notes: that for forward-looking analysis you have to use expected future returns and risk.

So no, you should not use past returns to measure risk. However, this does not invalidate risk management theory.
At RES we apply risk management theory using projected future returns and risks.