Basically, it’s saying, use Nextcloud, don’t get fooled by these privacy-oriented sites that may have some sort of open source client to access the service, but is running on pure closed-source infrastructure. I would agree that it’s smarter to use Nextcloud instead, but for email? Yeah, I’m not self-hosting that.

you still cannot verify that that’s the code running on their servers

This is why end-to-end encryption is paramount. You could be using Gmail as your provider for all I care as long as your messages are GPG-encrypted. Even if you trust the server-side completely (e.g. self-hosted), it’s still better to encrypt wherever possible, since it reduces attack surface.