I think that they were referring to the exploit that was recently published. Google researchers were able to reliably get the LLM to output training data verbatim, including PII.

To me, this reads as damage control for that. Especially as they are being sued for copyright infringement, which they and their proponents have been claiming is impossible (clearly, they were either wrong or lying).