In a simple substitution cipher you have a mapping of 26 letters like following:
A -> M
B -> Z
C -> V
The statistics for English texts shows that letter E has frequency 11.162%, T - 9.356%, A - 8.497%, etc. An attacker computes frequency for each letter in the encrypted text. If the text is long enough, then a symbol with frequency about 12% is very probably E, a symbol with frequency about 8% is very probably A, etc. In the example above suppose the text is long, and the frequency of M is 8.2%. Then the attacker will fist suppose that M in the encrypted text corresponds to A in the original text. The same for other letters. In the reality the frequency will deviate from this, and the attacker will test some other variants. Despite this the number of combinations that he will test will be relatively small, compared to a straightforward brute-forcing of 26! (1x2x3x4x5...x24x35x26).
You text about 26 x 26 means that they suggest not to replace a letter by letter, but a pair of letters to another pair of letters, like following:
AA -> GH
AB -> DT
AC -> LQ
BA -> BM
BB -> KA
BC -> OJ
ZY -> ZG
ZZ -> WM
There are 26 x 26 = 676 pairs mapped to other pairs.
For pairs the frequencies are also known and in case of long message or if attacker has many short messages, they still can be relatively easy decrypted. But for short texts it it can be hard.
Suppose the message has length 2600 symbols. In case of simple mapping it means that each letter on average is used 100 times. The correlation of frequencies with known values can be very high and decryption can be very quick.
But suppose this message was encrypted with polygraphic substitution of 676 pairs. Each pair will be used on average less than 4 times. That's why deviations of frequency of each pair from the known average values will be high. The attacker will have to test much more candidates for each pair. The amount of computations can be much higher than in case of simple substitution. Thus if the attacker has not sufficient resources (not enough computation power, not enough time), this can help to keep the message encrypted.
In serious cases, when encrypted message is valuable, more resources can be involved and also such cipher can be more or less quickly brute-forced. And an attacker will use of course not only frequency, but all possible information. E.g. the frequency of combinations of 3-4 letters, the frequency of some words in the language.