Their paper got accepted to S&P 2021. That is the top conference in computer security in case one is not aware.

Not justifying what they did but this apparently is still research.

This paint on canvas got sold and therefore it is Art.

What is that supposed to mean? Conference publications are for research.

I pulled this from the website of Oakland 2021

Since 1980 in Oakland, the IEEE Symposium on Security and Privacy has been the premier forum for computer security research, presenting the latest developments and bringing together researchers and practitioners. We solicit previously unpublished papers offering novel research contributions in any aspect of security or privacy. Papers may present advances in the theory, design, implementation, analysis, verification, or empirical evaluation and measurement of secure systems.

https://www.ieee-security.org/TC/SP2021/cfpapers.html

You’re defining whether something is “research” not based upon what it is or what it contains, but just based upon whether or not it’s been published.

I was pointing out that this is like defining whether or not something is “art” not based upon the work itself, but instead based solely upon whether somebody bought it.

Incidentally, my recipe for apple pie was printed in a newspaper, and so therefore my recipe is “news”.