Apart from the horrifying punctuation, I can't see how the quoted paragraph is technically incorrect. Some kind of real-world validation is required before you can trust that a public key really represents a given entity (at least, that's how I'm interpreting "verify fingerprints") and so it follows that if users don't validate the public keys of their correspondents, they can't know for sure that their conversations haven't been MitM'd.