I think they are trying to point out that a "session ID" is typically a key into session data stored on the server side, where the token is usually not just a key, but all the session data stored client side. With signing and other mitigations intended to keep that from being dangerous.

>Why were sessions inadequate

I suspect there are more reasons, but one is likely CORS and the tendency for the auth infra to be separate from the app infra.