The whole article seems like almost entirely fluff to me. The real concern they posed, and the question they didn't actually answer for some reason:

Which VPN providers are using replay scripts on their website from services that don't properly exclude passwords, payment information, and PII from the replays?

That's actually worth reporting about. The rest seems like fearmongering.