It's not as bad as it looks. Basically if your source code is audited and your random number is really random, you are fine.
A more easy to digest version of this news is here: http://www.coindesk.com/research-hackers-install-backdoor-bi...
If I get this right, it doesn't sound like sensible research to me at all. If you are able to get code to the victims computer, then you can just steal the private keys right away.
The private keys are not on the computer, but on a piece of hardware (like the Trezor). The researchers claim that they can get the private key from the Trezor, by feeding it malicious, unsigned transactions. At least that's how I understand it.
Similarly you can't just modify the message because the user can verify the destination address before committing it.
This is a method of sending out the private key within a normal looking message that no one else can detect (not even the person doing the offline transition).