That statement isn't from ars, it's from experts, and it's correct. Reverse engineer 12+ firmwares, make extensive modifications to their functionality, recomp

That statement isn't from ars, it's from experts, and it's correct. Reverse engineer 12+ firmwares, make extensive modifications to their functionality, recompile them, properly QA them, and use them as just one element of a complex malware chain is not a student project. The link you provided shows how much investment it takes to identify a small bit of firmware functionality and not even do anything useful with it.