This seems like an under-rated comment. You are right, this is a vulnerability and the blog doesn't talk about this.