[y7]

> exfiltration is obviously possible, I’m not sure why I would even need to specify that any page is able to read its own contents using JavaScript

Things that are obvious to you may be non-obvious to other people, including the readers of your blog.

[br0wnr1c3]

In the context of their blog post, it's assumed that the reader has some knowledge of web technologies — if you can print data to your own webpage, you can also exfiltrate it.

It's not reasonable to expect the author to explain _every_ underlying technology involved since that was likely not the scope of the post.