That just means they can’t sniff anything in transit. If the laptop is managed by Apple (they were an Apple employee) they have full access to an endpoint.