The paper does cross-validate the models, and I am told that cross-validation properly penalizes overfitting with too many parameters… but I don't understand the statistics well enough here.