I'm not familiar with Google Finance, but the author states "This part of the code is responsible for querying an external domain for a newsfeed to be displayed on the plot as an overlay.". I'm guessing they just happened to come across a Google Finance URL using the &ntrssurl= parameter and figured that would be worth digging into.

He says also in the comments: "Manual testing, the ntrssurl parameter was present in an example in the documentation for adding custom news feeds to the plot :) ."

Automatic analysis would have to be amazing to detect something like this. I'm assuming this was found manually. I wonder how long it took.

It really wouldn't, URL's like this in parameters are a huge red flag for both humans and automated tools. Any half decent analyzer would just need to see that parameter in any page it scraped.