The paper describes how to prevent the sniffing attack:

Website owners can protect themselves from the pixel reading attacks described in this paper by disallowing framing of their sites. This can be done by setting the following HTTP header:

X-Frame-Options: Deny

This header is primarily intended to prevent clickjacking attacks, but it is effective at mitigating any attack technique that involves a malicious site loading a victim site in an iframe. Any website that allows users to log in, or handles sensitive data should have this header set.

I wonder, why is this option an opt-out and not an opt-in? Shouldn't this be the default?