They say themselves that their demo is not real world and wont work in the real work and then say it "shouldn't be a problem" to make it work.
Not to mention that it takes 20 seconds of flashing the users screen to do the thing (how is that supposed to work without setting off alarm bells).
As I said, they have no proof of a real world vulnerability, only proof it a staged environment, and they readily admit it.