Exactly what I think as well. I have not looked into this attack for a while, but have always assumed it still is possible to proxy traffic via a user’s browser