Several of the attacks mentioned in the linked paper mess with data that receivers write to nonvolatile memory and reload when they turn on. As such you do not have to transmit continuously; some vulnerable receivers only need a brief transmission of corrupt data and they get stuck in reboot loops.

Needless to say, transmitters that only transmit for a few minutes a day are very difficult to locate manually compared to jammers that operate continuously.