Yeah, I'm not sure what flow lets you bypass that that GP is refering to. My impression was there aren't any, you always need to be able to see the screen to get the PIN code, and presumably there's rate limiting on trying codes.
This screen only protect you from entering wi-fi details to third party that's potentially malicious.
However, since the implementation does not ask users to input that code into Google Home app, it won't protect someone other than you (as long as they are in wi-fi coverage of the device) to configure or hijack your device. (and Google Chrome/Home drops down to this "waiting for configuration" state every time internet connection becomes unavailable.)
Latter is the issue I have raised.