The article does not suggest that devices can be attacked from the internet. The threat is VLAN hopping or lateral movement. That illustration is oversimplified.
I read through it - it doesn't seem like VLAN hopping would really be possible unless you can straight up get into the control plane and change the port configuration.
Thats at least 2-3 more steps from "RCE" basically.
I was being generous :-))))))) though maybe if some PFY had let the management interface exposed to the internet but that is a worse problem I feel.