This seems most likely the correct take to me (after a quick skim!). They use a very specific definition of sybils, allowing them to distinguish between regular and sybil nodes. Then they show that their mechanism works against that specific kind of attacker.

The math may work out (haven't checked), but it seems practically useless for the kind of sybil problems faced by permissionless cryptocurrencies. Two nodes that appear completely unrelated (different keys, different IP, different location, different client version, different everything), ie they look like two perfectly regular distinct nodes to the protocol, may be controlled by the same ultimate beneficiary, and there's no provably secure way of finding that out.

So imho the onus is on the authors to explain what their algorithm achieves, without hiding behind a wall of jargon and equations, otherwise it's probably safe to assume that it's just a marketing gag.