It depends upon what one is trying to do, and what resources one has available, IMO. If someone is actually working for an intelligence agency/criminal organiz

It depends upon what one is trying to do, and what resources one has available, IMO. If someone is actually working for an intelligence agency/criminal organization, or is part of an internal red team, then they have the time and resources to target specific classes of system, plan everything out, and build a package that will do exactly what they want against those specific systems, without any operator interaction. Most pen testers don't have the time to do that, let alone do it well, and there's a good chance that anything automated that they hack together will miss something interesting either because the person who built the payload didn't expect it, or because blindly doing all of the things that would locate interesting information would involve sending gigs of data back to C2. Knowing how to quickly improvise things like what's described in the article is super-helpful for the more generalized "see how you can misuse this system" type of pen testing.