That website contains two examples and five short paragraphs. I think this is reasonable

Even then, there are lots of edge cases with e-mail that are easy to get wrong and might become security risks.

I‘m not saying this applies to this project, this is more of a general concern.

The article explains exactly what it did measure and what this does not mean:

Every number in this post describes attacker activity reaching GreyNoise sensors, not confirmed impact on third-party environments.