You are right. It’s the reentrancy. What we want to highlight here is that the safeMint has an implicit external callback, which could be unknown by developers (if they know this, then the addressMinted[msg.sender] will be setup to True before the safeMint)