The article itself mentions running Firefox as root, but there's no way the user can be sure that's the infection vector.