the idea is if a malicious mining node choose to keep a transaction for itself and not propagate it to the network until the same node find a block and post that transaction in it, so the node will be able to pick the timestamp and the block number for that transaction ? and exploit a time-dependency functions inside a smart contracts.
In most cases, it's not worth the hassle for miners to do this. This is especially true if the miner is trying to pick the block hash, since this means they may have to throw away a perfectly good mined block. Also, if they manipulate the timestamp a long way into the past or future, other miners are likely to reject the block. But it's definitely possible.
For this reason, it's a good idea to try to avoid relying on things that miners can control, or if you can't avoid relying on these things, at least make sure the sums at stake are small - for example, gambling contracts usually use the block hash, and make sure the stakes are much lower than the block reward, so it's not worth it for a miner to try and manipulate this.