Article authors seem to be confused by the phrase: "Pass quarterly remove vulnerability scans". From what I know about PCI compliance, this is probably just a mistype and not indicative of anything actually meaningful. PCI compliance usually requires a quarterly security scan from a certified vendor. (The "Hacker Proof" "Hacker Safe" and similar badges are from these same services or similar.) These scans check your server(s) from the outside against a large panel of known-vulnerable software versions and common dangerous practices. They're useful tools, but no one should be misled into thinking they actually demonstrate security. The scans are typically passive only and don't do anything that could actually exploit a vulnerability or that require interacting with your site in any interesting way (such as logging in).
And it's not (as the article authors supposed) about removing vulnerabilities found in previous scans--you get the same (though updated) set of tests each scan and either pass or fail each time. Should you happen to fail, though, you can just upgrade, protect, or remove the problematic software (or make it hide its version number) and get scanned again until you pass.