He is referring to the fact that in Chrome click to play has no security effect at all - pages can click jack you to activate it.

To quote a Chrome developer: "Click to play is not actually a security boundary. In particular, it has always been subject to click-jacking."

https://code.google.com/p/chromium/issues/detail?id=174963