I believe they mean unrestricted as in not behind a firewall.

Heroku still requires authentication, but doesn't filter access by ip. If someone wanted to they could port-scan all of Heroku's (and really Amazon) internal network and find quite a few postgresql servers listening on network ports.

That's what this is intended to prevent.