The map / description in the blog post probably describes about 50% of all the applications running in AWS that I’ve seen, almost identically.
If they listed out security group and IAM configurations, or how exactly they’re connecting through the bastion, then it would be a little more risky, yes.