I think the person meant that if you don't comply there may be civil or criminal consequences, so if you want to knowingly provide a non compliant website or app, you should host it on tor to prevent your person from being the subject of the state.

I know the CA law is civil only, so I don't think there is much CA can do if you publish an OS and don't make money from CA folks, but other implementations may decide to impose criminal penalties.