The code used in the exploit itself itself looks rather harmless, as it was created to be a mitigation against finding players based on previously loaded chunks. https://github.com/PaperMC/Paper/blob/ver/1.12.2/Spigot-Serv...
The original version of this patch https://github.com/PaperMC/Paper/blob/d934dcc1e3e8b1ac34acef... fixed that desync, but it allowed you to force the server to generate an unlimited amount of chunks, which is an expensive operation.
You could only find players using this patch after it was modified to only reply if the chunk was already loaded. But at no point in time was this patch able to reveal if a chunk had been previously generated or not, that is a separate unrelated issue in which Spigot will reliably send a partial chunk on initial generation, but never for a previously generated chunk.
Take a look at https://2b2t.miraheze.org/wiki/Nocom