The title is confusing because it is poorly trying to mention the two potentially linked topics the article discusses:

1. Saudi Arabia jailed two Wikipedia administrators for their editing, arresting them in 2020.

2. The Wikimedia Foundation itself, in the last month, took significant action against editors in the MENA region [1], saying that they had inappropriate conflicts of interest in their editing and connections to external organizations, but also saying the "connections are a source of serious concern for the safety of our users that go beyond the capacity of the local language project communities targeted to address." The Foundation directly banned 16 users, which included a quarter of the Arabic Wikipedia administrators.

While problems with conflicts of interest are common on Wikipedia, and I haven't been involved for some time, so my perspective might be out of date, these are generally discussed openly, through normal processes, even in major and acrimonious cases like Scientology. My understanding is that it's very unusual for the Foundation itself to take this sort of drastic action; they aren't giving many details, as they say there are both legal and safety problems with doing so.

So the question/disagreement in this article is to what extent these two events are linked, and in what way. The two rights groups want more information made public, and appear to be suggesting that the agents involved used their administrator status in order to pursue the jailed administrators. WMF is saying that it would be unsafe to reveal more information. It appears that WMF, however, is suggesting the safety risks are risks of retaliation against individual users, not necessarily information security risks.

I would speculate that what isn't being mentioned directly is whether any of the users either had CheckUser permission [1], or were able to convince administrators with CheckUser permission to provide information to them. Normal Wikipedia administrators do not have the ability to access information about IP addresses and MediaWiki-sent emails of logged-in users; only a significantly smaller subset of administrators with "CheckUser" permission can see this. My guess is that when WMF disputes the "highest ranks" claim of the rights groups, they are interpreting that as a claim that CheckUser was involved, and users in Saudi Arabia were being unmasked by that access, while it's quite possible that the rights groups simply said "highest ranks" without intending it to have specific meaning, instead just trying to explain "administrator" in a somewhat overstated way for a non-Wikipedia audience.

If data access was involved, then it would be very concerning. But I think it's quite likely that the banned administrators were administrators more to facilitate pushing views on pages and influencing decisions on banning users / etc, while their retaliation against users and administrators only really needed their participation in conversations to identify target users, and research with openly-accessible user information and conversations, along with the resources of a state intelligence agency with wide-ranging powers, to identify the people behind those accounts. It might be easier to identify a users with access to IP address logs, but if you are targeting only a handful of individuals, and you can monitor all connections in the country, there are likely many other options, like looking at connection timings and publicly-viewable edit times over a long period of time. And even then, this assumes that you can't simply identify the users by what they've said.

[1]: https://en.wikipedia.org/wiki/Wikipedia:Wikipedia_Signpost/2...
[2]: https://meta.wikimedia.org/wiki/CheckUser_policy