These are both possibilities. The article outlines "new evidence — in the form of intercepted Russian intelligence documents, travel logs, and call metadata, along with eyewitness testimony". They don't claim to have the device itself, or direct information about it.
Next, there are some studies that find differences, and some that don't find differences between the affected and a control group. If the studies look at different markers, that is consistent with non-obvious differences being there. The absence of evidence sometimes is evidence of absence, but not always.
I think the proper response for now is to suspend judgment.