This bit of "wisdom" dates back to the very, very old days when security wrt computers was primarily a consideration for servers in physically secure locations. It is utterly obsolete, and every more so with each passing year. HSMs, CPU-level trusted modules, etc. have long since been a thing, as for that matter has even basic software measures like FDE. All exist in part or in whole to help with certain kinds of physical access. It is not in fact straight forward, reliable or for most attackers even possible to pull bits directly off a well designed physically secure chip with an STM or whatever.
I don't think looking back the actual weaknesses in MD5/SHA were related to ARX, but I'm not equipped to judge whether ARX might introduce TEMPEST related issues. It is not a fundamentally invalid consideration however. Side-channel attacks are one of the most classic and fiendishly difficult issues in cryptography and EM emissions are a known domain problem that can't always be solved merely via use of shielding. It's better even then to have it considered right down the primitive level. Layers and all that.
There are situations where an attacker doesn't have full physical access to a device but can still observe EM radiation. For example, someone sitting next to you with an EM receiver, observing emissions from your 2FA token.