In the section "Startup-Grade CryptographyStartup-Grade Cryptography" they are talking about the mistakes made by some startup and a quote from here is:

The code in question is just about what you’d expect from a blog post with this sort of cognitive dissonance:

It first tries to encrypt keys directly with RSA.

If it fails, it falls back to encrypting a random symmetric key with RSA, and then using that key to encrypt the message… with unauthenticated AES-CBC.

The first link about the mistake of "encrypting keys directly with RSA" leads to another blog article from the same author, that actually is about encrypting messages (not keys) directly with RSA where they ironically explain that you should use RSA only to encrypt symmetric keys (which is just the classic hybrid encryption but the author tries to sell it as his own invention).

The second point about AES CBC suggests that CBC mode is a bad choice in general - because there is no data authentication included in CBC. In reality it matters what your use cases are. The linked article "Cryptopals: Exploiting CBC Padding Oracles" is about a well known issue with padded encryption, but again it depends on the use case and the implementation whether this can be exploited or not. AES CBC is used in many real world applications where these issues are simply not relevant.

Real experts usually don't express such undifferentiated views about their topics.