You'd really need to see the paper to evaluate this, because pretty much every static analysis technique can generate lists of "undetected security flaws", especially if the corpus of application code is unconstrained. You'd want to know:

* Did they find a kind of security flaw that is particularly difficult to detect? Like, reliable generic authorization bypass detection result would be novel.

* Did they find 23 flaws in popular and important Rails apps? Those applications have probably been tested extensively already, and new results are interesting. Random e-commerce applications buried in Github, less so.

* How severe were the flaws? Security flaws range from remote code execution on the very damaging side to version information disclosure on the marginal side.