He has written about it before, but listening to the podcast, the most interesting part for me that led to the Freund's discovery is that the hotspot had no debugging symbols attached to it. In free software, trying to hide something actually makes it stick out more.

I wonder if a subsequent, more sophisticated attack could add some bogus debugging symbols to better hide its track.