[lisper]

> Am I understanding correctly that while they enumerate a list of potentially useful attack vectors, there are no actual attacks (yet)?

Hard to say. The sorts of people who are capable of finding these kinds of exploits don't advance their careers by publishing.