This is sloppy summarizing by ars. In a real attack tampered logins need not show up as failures.

From the original article https://mega-awry.io/ (emphasis mine):

> Since the server code is not published, we cannot implement a Proof-of-Concept (PoC) in which the adversary actually controls MEGA. Instead, we implemented a MitM attack by installing a bogus TLS root certificate on the victim.

> ...

> The log in attempt fails, which is only a limitation of the MitM setting. A malicious cloud provider can perform this attack without the user noticing.