I think they're referring to the verification end, in terms of being required to hand over personal info to various parties, a certain percentage of which will have insufficient security and be compromised resulting in your info being leaked.

Or otherwise that if you want to effectively ban VPNs you'll end up at the point where secure encryption is effectively banned, because there are ways to tunnel traffic over pretty much any protocol eg. SSH, HTTPS if you're creative.