It's talking about email verification, not password reset systems. In other words, those types of URLs should only establish a connection between an account and an email address: they shouldn't act as a means of authentication.
Aren't both of these equivalent though?
(I would think the point may be that a compromised email, doesn't provide access later. Both these scenario are equally vulnerable then?)