That page incorrectly identifies man in the middle attacks as messages being manipulated on an unencrypted connection.
In fact, a man in the middle attacks occurs when the connection is encrypted, so you might believe you messages are safe from sniffing. The attacker intercepts messages from both parties, replaces their public keys with its own so it can decrypt all the messages, then re-encrypts them with the other party's key before forwarding them on so they still see the connection as encrypted.
The way to avoid that is with digital certificates. Those are mentioned in the next section on the page, but as it's presented you could imagine that it's a separate step layered on top of an encrypted connection, when in fact it needs to be intimately tied to key exchange to verify that a man in the middle attack hasn't taken place.
