That's not how Proton works. If you have an organization, you have complete control over all the accounts. I can reset passwords for any email address in my organization and read all their email if I were so inclined. He's not talking about individual accounts which are how you describe it.
For non-private subusers, you're right, but for private subusers, you can only read new emails after resetting the keys, you can't read existing emails. I.e. you can take control over the email address, but not access existing data.
