They're saying don't write such a parser in C. Use something else (memory safe language, parser generator, whatever).
If it hands it to a C program, that C program needs to parse (in some form!) those values!
How is a C program expected to ever do anything if it can’t safely handle input?
Probably not that important for `ls`, probably worth it for OpenSSL.