I understand their point - a cookie can be used purely for a session ID, without using it to track the user for other purposes (e.g. a cookie unrelated to the session could be used to track which pages the user visits, regardless of whether there're logged in)