They're probably trying to say the connection will still be securely encrypted, albeit without the guarantee that communication is between you and the party / identity you expect on the other end (possible MITM attack scenario).
Say I present a self-signed, expired certificate with a bad signature and the wrong domain name. Which one does the user get warned about?
This has important practical concerns. A cert being T+1 second expired is irrelevant from a security standpoint, but if that short-circuits all the other checks...
With a sufficiently short lifetime, you can throw up another barrier to compromises.
2+ year expiry on certificates has been pretty commonplace until LetsEncrypt's 90 day policy.
It's absolutely possible that this could occur, but practically, the difference between a correctly issued but expired cert and a non-expired one is minor.