Here’s the whole thing. Read it in context. August 10 says they didn’t submit to the network but confirmed with the devs that they were syntactically valid. Then they updated that to show that they could change payment amounts. 
Maybe the Iota devs are right that on the network they don’t verify. I don’t think it’s really implied that the researchers tested it on the network. The whole piece repeatedly says they didn’t send things to the network.
If I get your criticism, what you’d like is an extra sentence that repeats the explicit “We didn’t test against the network” language of the previous paragraph AND a note that “they could be used to steal funds IF signature verification in the net is syntactically identical”
I mean it’s a fine criticism. I’ll pass it along to the researchers. I don’t think it really changes much; maybe the attacks don’t work on the network, which is consistent with what they say throughout.
