They are probably referring to this issue which was also extensively discussed here in the forums: All user email addresses exposed in NC20+
However, the issue has been fixed in the meantime, i.e. the global address book can now be disabled by a system administrator: https://github.com/nextcloud/server/pull/39925