I completely agree that it could be an actual thing. From a hardware and security perspective it is, as you say, all of the shelf hardware and techniques, ARP

I completely agree that it could be an actual thing. From a hardware and security perspective it is, as you say, all of the shelf hardware and techniques, ARP poisoning vs. MitM DHCP server have tradeoffs which have slipped from memory, but you can basically go either way. The doubt is entirely about the hype and false appearance of a third party news story. Maybe the intent is to highlight the problems with using unencrypted HTTP? I can dream that it's a well intentioned stunt can't I?