The article does not claim the keys are still in use. It specifically says "missing containment actions". Everything is tainted because you don't know what secondary actions were executed using the compromised keys.