I think the parent means that you should be able to talk to the NIC about the computer, without the NIC needing to get the CPU powered on so that the CPU can tell the NIC what to do. Like a very-minimally-functional BMC.
As far as I'm concerned ME-equipped NICs should unconditionally be behind VPNs, but the AMT functionality itself is really cool. Even the 10+ year old machines that don't support VNC let you remotely hit CTRL+ALT+DEL, issue an ACPI shutdown, perform a hard reset (equivalent to hitting the reset button on 486-era boxen), etc. So basically you can do either soft or hard shutdowns or reboots. Quite granular.
I actually used the hard-reset functionality while playing around with Linux early boot on a laptop a few years ago. Rebuild initramfs (loaded via PXE), use `curl` to hit AMT reset endpoint. Very cool.
Lately this has been my biggest barrier to leaving a computer fully remote.
I kneejerk-recommend a bastion host because a) Intel ME, and b) there was that all-0 password bypass a while back and uhhh yeah who knows what other "sneeze correctly and the leaf falls over" knock sequences there are.
SSH port forwarding, VPN, RPi running the remote-access AMT web UI thingy (runs on Linux, forget what it's called) behind nginx with authentication... you get the idea.