"Android phone owner accidentally" Vs. "Cybersecurity researcher"

Thats a very deceptive headline - the first one implies an everyday joe, and the second one implies a highly specialized expert in the field.

You also need access to the PUK, not something you'd have easy access to unless you already have nefarious ways to access that from the service provider.

This only applies to 2 specific models of phones - the 1000s of other android devices not affected.