This implies that their definition begins and ends with that paragraph. I would tend to go to them and ask them to verify that this limiting definition was exactly what they had in mind (as opposed to a simple blurb); that additional lending controls are in use by IA, including controls which are not explicitly written into that paragraph, is something that is easily validated online.

If they do agree with you that the paragraph you pasted is their end-to-end definition of "controlled," that means they haven't yet incorporated these other controls into their definition, and they definitely still can and should.

There's no singular time limit or definite requirement to define such things in this case, and IA have engaged lots of controls, from HTTPS and authentication on up to content-level media and time controls.