Exactly. Attacker is already in God Mode. Doesn't need to be probing password managers. The report has some value in testing a claim about how well secrets were hidden in or scrubbed from memory. Not like advertised...

Ill also add that mitigating stuff like this was an early, easy use of separation kernels. They put the secret-protecting components, like disk encryption and VPN, in dedicated partitions outside Linux VMs. That worked well.