There may be a phrasing issue. Parts of iCloud data are protected with a device passphrase / passcode (or specifically: a encryption key generated based on that). Further, your iCloud account is protected with a password of course. So these are two layers of protection, not quite one or the other like the text may imply.