This is what I thought, too, but they explicitly state "access to devices", not "access to data".

Could also very well be that the author didn't distinct between the two sufficiently.