The supposed story about it is hosted on the homepage of the device in question, and I see no other hits for it on Google.
Edit: It looks like ibejoeb has the right of it. It is a hoax in the in the stunt/prank/hype/performance art manner, rather than the malicious deception sort.
Still, the hardware (a Sheeva Plug?) and consequent hack described is very possible, tho I understand that setting up a man-in-the-middle DHCP server to override that on the public hotspot is more straightforward.
From a hardware and security perspective it is, as you say, all of the shelf hardware and techniques, ARP poisoning vs. MitM DHCP server have tradeoffs which have slipped from memory, but you can basically go either way.
The doubt is entirely about the hype and false appearance of a third party news story.
Maybe the intent is to highlight the problems with using unencrypted HTTP? I can dream that it's a well intentioned stunt can't I?