Since they mention a DNS rebinding attack, I would assume the victim visits or is redirected to attacker.com. This then has all the JS to talk to the unsecured

Since they mention a DNS rebinding attack, I would assume the victim visits or is redirected to attacker.com. This then has all the JS to talk to the unsecured router API endpoints. Now after a few seconds the attacker.com's IP address is switched to 192.168.0.1 (or whatever the routers default IP is) and zap: the SOP is circumvented.