The problem with what Bloomberg reported was not that it was implausible, but rather that it was unsubstantiated as to whether the attack actually occurred. If Bloomberg had narrated the article as "this could happen", attempting to explain a possible attack vector, that would have been fantastic.

I do agree there was a lot of "but SPI requires 6 wires and the slave can only respond when talked to" (treating SPI with the assumptions of a design engineer rather than an attacker), but that was ultimately just noise.