It means just that. Since they had control of DNS, they could have easily gotten a DV certificate, but in this case, they didn't and people clicked through certificate warnings.
Which is a shame. They could have prevented users clicking through warnings by implementing HTTP Strict Transport Security.