I think they're imagining situations where an attacker could gain user-level access to a machine that normally wouldn't be accessible to them at all, e.g. a web

I think they're imagining situations where an attacker could gain user-level access to a machine that normally wouldn't be accessible to them at all, e.g. a web server with a weak SSH login.