In this context "exposed to the internet" means stored on a device that connects to the internet. If an adversary somehow obtained your XPUB they could reconstruct & surveil your transaction history & wallet balance. It being stored on an internet connected device that you presumably carry with you most places that you go. In the setup referenced in the video, deposits can be made directly to receive addresses; the XPUB never leaves the device. This would an advanced strategy for extremely privacy conscious people, but as long as you're saving and not spending, the XPUB never has to leave the device.