I can't make heads or tails of this comment, likely due to hn formatting.

But as far as I can tell, this exploit requires 3-4 zero day exploits to be discovered in a system the attacker has no access to, and to all go undiscovered for an unknown amount of time for while said attacker is exploring.

That's much better than "I can steal user credentials and then download an exploit trivially."