It's increasingly common in modern ICs (SoCs and microcontrollers especially) to have only the minimum required connections be permanently assigned to physical pins. The rest of the pins are connected to some routing logic which in turn connects to the various chip internal signals. This is great in board design because you can often simplify PCB routing by reassigning pins as you need them for your layout, rather than other other way round.
This is usually done at runtime, typically a bit of code that happens after the reset vector that puts the various config values into the appropriate registers that set up this routing and other customisable options.
In the case here, it's those other options that are the issue.
From the paper, Part IV(A):
> The Micron image sensor has a 16 bit
configuration register, RESET (which is distinct from the
#RESET power on reset signal). RESET is addressable from the I2C interface at address 0x0D in register page 0
And the hack involves setting that configuration register to unexpected values to enable functionality that bypasses the LED display circuit:
> Bit 7. Prevent STANDBY from affecting entry to or exit
from the low-power state if set.
> Bit 6. Prevent STANDBY from contributing to output enable
control if set.
(where STANDBY is the signal/pin to which the LED is connected)
So the controller assumes that the physical STANDBY pin will always accurately reflect/control the state of the sensor, which is not necessarily the case if it's been disabled by re-configuration.