"All malware, no matter the details of its code, authorship, or execution, must consume power. And, as PFP has found, the signature of malware’s power usage looks very different from the baseline power draw of a chip’s standard operations."

I stopped right there because I smell assumptions that any number of things might violate: background tasks, VMs, VPN software, background P2P networking software (e.g. belonging to a Kad network), auto-updaters, debuggers, system profilers, management software for IT asset control, etc.

That and malware authors would immediately set about working to make their power profiles more typical. What they've found is that current malware produced with no attention to obfuscating this aspect often looks different from current typical application code.

Can't see this being robust at all. Sounds like a whole pile of false positives too. I suppose something like this could be used as part of an array of detection methods deployed to devices to help monitor for suspicious changes in baseline activity that could then be investigated.