This article is grasping pretty hard. You mean to tell me if a role was misconfigured to allow anyone to assume it, and someone guesses that role name, then they'll be able to assume it?!

The only part of the article that is interesting is the difference in error messages that allows you to confirm whether a role exists or not, but I suspect that wasn't enough content for a blog post so the scary implications of misconfiguring security policies was thrown in.