It is simply reiterating the most basic rule of internet security - never trust anything from the client (aka presentation layer, aka browser, etc...). Since the "presentation layer" operates on an external system (i.e. the computer of the person browsing your website) the server/website has no control over what happens over there, and therefore can't trust anything it says. As a result, it must re-verify everything itself. An example should help.
Imagine you have a user portal, and there is an admin portal that is only for users that have been given permission. The presentation layer "enforces" this access restriction by simply not showing a link to the admin section if you are not an administrator. This, by itself, is not a sufficient access control. The server itself has to enforce that access control and deny access to the admin system to anyone who is not an admin. If it doesn't then any user can access the admin system by simply typing its location in their browser, and automatically gain access to the admin system. This is a simple example, but also the most common:
- Presentation layer: don't show links to areas the user doesn't have
- Server side: Reject a request to an area that the user
doesn't have access to
If you only do the former you have a problem.
So that's the short summary. The server cannot trust anything the browser says because an attacker has full control over what the browser says (in fact they may not even be using a browser, but may simply be pretending to be one). Therefore, the server has to verify everything itself.