Does that boil down to "if root is malicious, Bad Things can happen to other users"? Well...duh. Why not keylog all terminals instead of fumbling with ssh-agent and connection multiplexing?
ssh-agent is like temporarily uploading your private key to each remote server logged into.
The GP is mixing together SSH agent with agent forwarding, and private keys with key signing by agent.
There is last week's CVE-2016-0777, which is a vulnerability that enables the exploit you are describing, but in a properly patched configuration, without agent forwarding (nb: this feature is off by default), this is not the case. Same with connection multiplexing: off by default (for good reasons). In other words, either a) please explain how that would work, or b) please stop spreading FUD.