For ssh they both have private and public keys. The server could be at risk of having it’s own private key compromised if somebody breaks in, and vice versa a compromised client can lose its private key. The original wording made it sound like a compromised server would steal client keys.

Also passworded keys are recommended