It means essentially that. The alternative is an attacker bringing/installing their own tools post-compromise. Living off the land is more stealthy because you

It means essentially that. The alternative is an attacker bringing/installing their own tools post-compromise. Living off the land is more stealthy because you’re using legitimate system tools to do malicious activities