> To clarify though, that requires an external attacker-controlled process to monitor the GPU, yes?

Yes, they do it with high-speed probing of the amount allocated GPU memory. This requires access to native APIs (specific OpenGL extensions in this case). Like you said there seems there would be simpler ways to achieve this, but the demonstration of this side-channel is still very interesting.

Varying the size of the textboxes might not help because the rendering engine of browsers can have a memory allocation per letter for example.