hash – How can a collision attack reveal my private key?

From “Mastering Bitcoin: Programming the Open Blockchain 3d Edition, Ch4”:

Any address based on a hash function is theoretically vulnerable to an attacker who independently finds the same input that produced the hash function output (commit). In the case of Bitcoin, if we find the input in the same way as the original user, we know the user’s private key and can use that user’s Bitcoin.

Bitcoin uses elliptic curve arithmetic for private and public keys. The only thing that is hashed is the public key, so the best thing we can make public is the public key. Isn’t that right?
(P2SH is not being considered)
Or could I somehow obtain the private key through a successful collision attack?