Just to avoid any misunderstandings, from the article: "There's no indication the driver package uploads or otherwise distributes any of the logged information."

The software writes all key presses to a debug logfile on your own machine (which is overwritten on each reboot), it doesn't send them anywhere. This is bad enough, especially given that the file apparently is readable by any user on that machine. But it's not really a malicious spying tool, it's "only" really sloppy programming.