The google document being used talks about crossing an origin-boundary.

So website with bad script injected is loaded by the user and is able to make requests to a logged-in banking website with time-based/scrolling attacks.

Does this matter when the server (well, multiple servers when you throw in ads as well) are running their custom Javascript on the client, which has access to not only the viewport coordinates, but the URL itself?

Right on. This article is bull