But the Wifi provider can't inject their own mining script on arbitrary sites with https.
This wasn't injected though. It's a splash screen that pretends to load for 10 seconds (whilst mining) before forwarding the user on to some starbucks rewards site.
That is true, but usually the wifi login portal is not under https, which seems to be what the article implies.
But they won't be able to inject the miner into HTTPS protected sites.
If you look at the screenshot of the code it isn't an injection. It's a deliberate redirect page put in to delay you for 10 seconds whilst they mine bitcoin.