Are you arguing that the attacker would have to eventually exchange XMR for something they could purchase goods with, like toilet paper? Because I think that's shifting the original argument a little. The point being made is that had they had the victim(s) buy XMR on an exchange and send it directly to their XMR wallet and maybe cycle it through a few wallets, it would not have been traceable, which still holds true.
How the attacker would actually use that money is a separate discussion. I've never looked into it but I'd guess there are illegal/grey services that would provide this service for a fee.
How the attacker would actually use that money is a separate discussion. I've never looked into it but I'd guess there are illegal/grey services that would provide this service for a fee.