Is that even true? In practice rather than downloading a single package you'd download/update a bunch of packages over the same connection, and an attacker would only see the accumulated size, right?
And the Debian contributor who wrote TFA says it's possible, and I'm sure he knows a lot more about it than I do.
That doesn't mean it's impossible to determine what packages you downloaded. But it will be more effort to do so.