When I started the article, it seemed like a very unlikely attack, however it's actually quite reasonable and something I've actually ran into before. I use a lot of different addresses and when I've had to recover them using the master seed, I had to brute force search for them all (easy on my computer, but probably far worse on such a small device.)
Kudos on finding an attack vector from something that seems so small.