The "practical example" in the article is the exact opposite of that, it searches for the hash of a known favicon and filters to sites that shouldn't match it b

The "practical example" in the article is the exact opposite of that, it searches for the hash of a known favicon and filters to sites that shouldn't match it but do. It would require a particularly incompetent attacker (or a very contrived case) to not match the favicon of a public website.