This does not help with the initial compromise, but they demonstrate that with a software-only change, you can use existing LEDs as receivers in addition to senders!
That leads to the obvious question for high-value systems that may be targeted - presumably fixed systems not laptops/notebooks/tablets - are the activity/power LEDs commonly connected via software-controlled GPIOs or mostly part of the electronic circuit only ?
Looks like it's all doable digitally.
For a lot of chips changing the purpose of a pin may not be possible unless you are a nation state and have all of the design info on an ASIC.