This is sadly a text written with much confidence about something they understand very little about. Especially the part about the GDPR is IANAL completely wrong.
Yes, DMs over AP are not secure. That’s why there is the big banner above it in nearly every AP implementation. The rest is pretty much FUD.