I believe they are referencing the fact that upon a login attempt the server does receive a plaintext password per se.

Usually it is stored in memory only long enough to compare it to the hashed version from the persistence layer but... that's in theory.