They might be referring to frontend code (it's kind of unclear), but flags are found everywhere [1] and you need to treat them with diligence at every part of the stack.

You don't want your flag combinations contributing to invalid responses, or worse, persisting invalid states. (A well engineered model will have protections in place, but good flag hygiene helps.)

[1] I've found them in service discovery, monkey patched into 3rd party libraries, load balancer code, etc. Flags get used everywhere.