[throwawayKiwi9]

Did you skim over the part where there's a toggle to strictly prevent sending messages to unauthorized devices?

[tptacek]

No, I did not. There are like 7 different horrible vulnerabilities in this paper, and you're talking about a different one (the one where the server can add new devices to people's accounts!) than I am (the one where the server can add random people to your channel, whether they're verified or not).