Note that this statement is about OpenVPN Access Server, the commercial distribution of OpenVPN.
There is a bit more info in the "community" wiki [0]. It seems the key point is that TLS-auth would already mitigate the vulnerability. TLS-auth is on by default in OpenVPN Access Server, but for the vanilla openvpn, you have to configure it yourself.
And, as noted in the community statement, the TLS-auth is a single global pre-shared key. It could leak a bit more easily than personal certificates.