They point they were making that wasn't clearly elaborated upon is that the code in OpenSSL for FIPS compliance is a charade and is only there to satisfy FIPS requirements. The presence of that code doesn't guarantee or ensure the anything.

These compliance standards generally exist to deflect liability in the event of a breech and aren't necessarily there to protect anything. Take PCI for example, much of the DSS requirements are verified by audit and if you've ever gone through the audit, it's mostly certification without verification. The auditor usually trusts that things like segmentation diagrams are accurate. There's a level of accountability but it's primarily about deflecting liability.