If you read the example very narrowly as "get the user to download a bare DLL to their browser downloads folder and then have the smart card app execute the ini

If you read the example very narrowly as "get the user to download a bare DLL to their browser downloads folder and then have the smart card app execute the init logic in that DLL", then yes, that would face a variety of further challenges -- although not insurmountable ones. But I didn't read it that way anyway. Because it was an illustration and not central to the article, I read it generously as "as one example: given a pre-installed malicious dll, this particular extension could trigger its execution" which was sufficient to demonstrate that it presents a real and immediate opportunity for making arbitrarily bad things happen.