They are saying if you download an application (e.g. vrchat.exe) from the internet than it can steal your passwords as soon as you launch it.
"Every month, thousands of users have their accounts stolen, often due to running a modified client that is silently logging their keystrokes as well as other information. These users – often without even realizing it! – run the risk of losing their account, or having their computers become part of a larger botnet."
People running a backdoor client and getting their passwords stolen? That doesn't sound... wrong?