I think they're talking about opening the router firewall to inbound traffic, as opposed to the standard outbound traffic.

But you only open it to your red zone machine, which should be a separate net from everything else. You're not opening your entire network to inbound traffic. If you get hacked, the damage is limited.