It is not misleading in any way, actually. It accurately and factually reports the difficulties one has to grapple with in order to use this exploit successfully. It paints a picture of this exploit as being limited in scope, limited in execution, and limited in use, all of which are true.
The sentence after the first one you quote explicitly explains this sentence, so it is not misleading.
The author never alludes to the idea that "many apps are not at risk" equals "nothing to worry about". He links to an e-mail that describes a list of apps that are apparently not affected by the bug. In fact, the point at the beginning of the paragraph, "not all applications are at equal risk", very fairly summarizes his point.
The third point about obsolete functions is a minor one, but again, accurate and useful in lowering the scope of potential attack targets.
Finally, we know how to exploit this. Qualys is even going to release a metasploit module. And the risk is small not because we don't understand it, but because the risk is small, as has been pointed out many times in the article. It's been figured out. It's very simple, and it's not very useful. This article explains that.
--
What the article doesn't explicitly mention is the real silver bullet in the whole thing: you have to inject a DNS record into gethostbyname's buffer that is an invalid record. It's bigger than DNS records are allowed to be and uses invalid characters. So every DNS resolver and server in the world is going to ignore it. So the only way you can really exploit this reliably is by 1. hacking a DNS resolver used by a server, or 2. man-in-the-middle attacks. It is nearly impossible to use this attack on random targets on the internet.