It almost sounds like part of his concern is that the web server could view the content you are requesting. But this is always true for IPFS data since it's public and available to anyone with the CID.

Also you can use the CID (which is a hash), to verify the content hasn't been tampered with.