It sounds like what you're describing is passing a capability to withdraw balance (which is implicitly captured in an erc20's internal state via `approve` [0]). Of course, cap handling is probably a bit unwieldy for a snippet in a whitepaper, so they're likely making the assumption of "don't call untrusted code." I don't see a construction for sender delegation, so at least it reduces the TCB to the immediate callee.