No, they say it as if cookies don’t have a built in authentication or encryption method (when the client is untrusted).