They're referring to how in js, the for...in loop includes properties from the object's prototype.

There used to be much concern around the idea that you might load some third party js that adds thing to the base Object prototype, which will then be enumerated with for..in loops on all your data objects.

I always thought this was a stupid vulnerability because if you're executing malicious javascript, you are already screwed in a much more direct way

[Edit: i was mixing this up with a slightly different vulnerability that is a bit sillier than the one they are reffering to]