I think that the hint's wording is a bit incorrect.

"Syncing" calendars via MobileMe has no great security risk, only the MobileMe account owner can get access to them via their MM password and login credentials. It seems as though the first step of turning off syncing is unnessary and defeats one of the main purposes of MM - namely syncing of calendars between a single person's various devices.

"Sharing" or "Publishing" your calendar via MobileMe and iCal does however create on the MobileMe servers, a read-only online web calendar and downloadable ics calendar file with no protection other than the obscurity of the calendar and user names. Maybe what the original author intended for the first step was to say something like: "If you are "publishing" the calendar in question, turn off the "publish/share this calendar" setting."

Putting the calendar file in a place accessible to other members of a "family" pack seems like a pretty good idea, but I have been using BusyCal and its integration with Google Calendar in order to share read/write calendars with family members, do doing it with iCal is unneeded by me.