Yeah. It's not as severe as the article makes it seem. It's just a bypass in a very insignificant component for which you need 2-3 other vulns to exploit.

I presume the editor just wanted to put an article out with Microsoft and Project Zero in the title, rather than analyze the actual flaw in the context of its severity.

There is a lockdown mode which restricted which COM objects could be instantiated from .net code to a short whitelist.

The whitelist is based on GUID. The lookup of GUID to actual binary is done through the registry.

COM hosting implementations should check that the object they got is the one they asked for. Net doesn't. So if you can write to the registry you can escape the sandbox.