Generally, "cloud images" are configured to run in a IaaS (infrastructure as a service) cloud computing environment, like Amazon EC2 (a "public cloud" provider — you pay for metered resources from a provider) or OpenStack (software to implement your own IaaS environment).
These environments typically provide a metadata service which can be used to provide configuration information to individual instances. Cloud images are often configured with a provisioning tool like cloud-init which looks for such a service and responds appropriately. This can be actively dangerous outside a known cloud environment — if you, for example, launch a cloud image on your laptop in a VM, some hostile actor could be running a metadata server and basically pwn your new VM.
Additional configuration might include optimization for performance under a particular provider, or lack of a default packet-filter firewall (because the convention is that the cloud environment provides similar functionality via its own APIs at the network level). But this will vary from distro to distro.
The images distributed by the distros will be "sealed virtual machines" in the sense given in the document you link. That is, they're void of unique identifiers and ready to provision. But, you could also have a sealed virtual machine that's meant for another purpose (like a dev environment meant for running on your laptop).