Comment by tadfisher

The post itself is pretty comprehensive. I'm not sure they need to pinpoint the exact attack surface in the TLDR, but your version isn't exactly correct as they point out three mitigations and only one of them is a CSP policy for the API Log viewer.