It’s not detailed enough to really know what they meant, but for example and if I recall correctly, Android on a phone can get rootkitted in such a way that resetting the phone will not remove what was installed. This is because Android has a “System” partition and a “User” partition. When you “reset” a phone, it only wipes the user partition in most cases, so any malware installed to the system side would be untouched.

This is why you have to be real careful if you should purchase an Android phone second hand from a private seller.