I assume by "third party" they mean an outside request from someone who doesn't own the service they're hosting. MIT is unambiguously the first-party owner of MIT.edu, even though a third party used Cloudflare to hijack it.