Does ActivityPub even share the user's IP address with other nodes in the network?
No this is not in the specification.
A malicious instance could in theory distribute this information but it would be non-standard. Of the 2 systems I've studied - Mastodon and Lemmy - neither do this.
Are they talking about your IP address or the service's?
In this scenario they would be talking about the IP address(es) of the services.