rsync by itself provides no encryption, and i wouldn’t use just rsync by itself. That’s probably what he meant.

You should use something else with rsync that encrypts the data before uploading it to a server that you don’t own physically.

Or use restic, which takes care of the uploading part too, so you can skip using rsync altogether.