It might be an oblique reference to the fact that the filesystem code hasn't been specifically hardened with respect to a maliciously-crafted filesystem image.

Traditionally this was not seen as an attack vector, because only root could mount filesystems anyway (and without filesystem encryption, someone who could modify your filesystem image could just modify any binary to add a backdoor).

This is why only specifically whitelisted filesystem types can be mounted in unprivileged containers.