Microsoft is well aware that things can be spoofed, and has a very talented threat intelligence organization that would not make this claim without substantial proof.

This includes things like encryption keys and other non-public identifiers. Should those items be made public, the adversary they are combatting would then roll those indicators and leave Microsoft blind. This isn't unique to Microsoft either, most security / threat intelligence companies have their own swath of private signatures.

The sites reporting on this are aware of that issue (non-public signatures) and as such do not need to offer a disclaimer. Microsoft is the one making the claim and they have the reputation to back it up. Unless there are solid reasons to question Microsoft's work there is no need to include your unlikely scenario.