Comment by Scalestein

I'm guessing they are thinking of a scenario where SELECT * FROM User_Details gets sent directly to the front end.

So even if all you are displaying is the users name or initials you would still be sending things like SSN and credit card number to the front end