That bit about authority being a signal that is distinct from PageRank sounds like a big clue to me. The nofollow attributes still stop a link from sending PageRank, as "advertised". But it doesn't mean that a social media mention won't influence the SERP at all.
It's also interesting that they do use the "authority" of the person posting as signal. This would, to some degree at least, help to prevent gaming the social signal with bots and mechanical turks.