In summary, they found out that in spite of EMET protecting a wide variety of functions, EMET has a function and a global variable that turns off EMET. So they can call it or set the variable and EMET is bypassed.

Why bother with all the fancy tricks to get around the various protections when you can just ask EMET to turn them off for you?