The implication is that they're pretending to be legitimate employees whereas they are actually exfiltrating IP from a hostile nation state. Seems valid.