I thought NTP was a protocol, not a piece of software. Is the article conflating them, or is there only one single implementation of it that everyone relies upon?
There's OpenNTPD which is maintained by the OpenBSD/OpenSSH developers. It has been poorly criticized for its focus on security rather than absolute precision, but it's more than adequate for most peoples timekeeping needs.
it's more than adequate for most peoples timekeeping needs
Yes it is. I'm on a cable modem and currently using OpenNTPD to talk to 5 NTP servers. My largest offset is currently 3.6 milliseconds. That's fine for general purpose computing. Anyone who needs better should probably buy some NTP or PTP hardware for his LAN.
Don't forget the billion-plus machines out there running Windows Time Service (which strangely has had zero security issues I can remember, even when running in server mode).
W32Time has different kinds of issues, in my experience. With it, one's problems tend to be that, by design until very recently, it doesn't provide to-the-second accuracy.
http://www.openntpd.org/
It has privilege separation, sandboxing and if your OS/distribution uses LibreSSL it implements HTTPS constraints.
http://man.openbsd.org/ntpd.conf.5
http://man.openbsd.org/ntpd.8
http://man.openbsd.org/ntpctl.8