If you read the end of the article, it suggests a similar idea of adding something to the callback on return that the attacker cannot guess. However, this requires a protocol change which both providers and consumers have to implement and is not something we can roll out overnight. It requires a new version of the protocol.