If you are using IAP in your app and want to keep this hack from working you should be validating receipts. It isn't hard to do, check out https://github.com/carsonmcdonald/iap-validator for an example.
It wasn't clear from the article if the method could bypass that. It would have to provide valid transaction ids to the app developer's server. That seems a little too sophisticated or impossible, so you're probably right.
I guess we should really just be surprised this wasn't done sooner.
Even if this method does manage to bypass Apple's validation, then it is Apple's problem and they will fix it quickly. But it is much more likely that developers just haven't bothered to validate receipts.
It's a tradeoff, really, that most IAP implementors consider:
Cost of support and loss of goodwill when legitimate customers run into issues vs. loss of revenue from pirates (heretofore only jailbroken phone users) who likely wouldn't have purchased anyway.
It makes fiscal sense for big players with big IAP scale like Zynga to strictly validate. Little players may find it is less critical to the bottom line to be strict about it.
If the value of the status key is 0, this is a valid receipt. If the value is anything other than 0, this receipt is invalid.
http://developer.apple.com/library/ios/#documentation/Networ...
Also that page has an invalid ssl cert :)