firebaser here
Good catch, that piece of documentation probably should be clarified.
Inbound requests are allowed, as long as you're within your allowed quota. So your app can call a Cloud Function.
Outbound requests for projects on the free plan are only allowed to Google-owned services. So your Cloud Function code can only call google owned web APIs, unless it's on a paid plan.
Update: the above applies up to Node.js runtimes up to v8. From Node.js 10 and upwards your Firebase project needs to be on a paid plan to be able to use Cloud Functions. For full details on this, see the Firebase FAQ on Cloud Functions pricing.