The Device Administration API provides the DevicePolicyManager.wipeData() method which device admin apps can call to perform a factory reset of the device, wiping all user data and applications. This requires the device admin to have wipe permission granted by the user.
The Android Device Administration API gives device-admin apps the ability to enforce policies and, critically, to remotely wipe the device's data (restore to factory settings), which is how enterprise MDM/EAS-type apps remotely erase a lost or compromised phone. So the statement is true.