Title makes it sound like a bug is discovered. The 'trapdoor' is in the protocol by design. A lot of zero knowledge proof protocols have an initial setup phase in which values are created that need to be forgotten for the system to be secure. These values are sometimes know as 'toxic waste'.

ZCash has a good write up on how this went in their zero-knowledge proof based system: https://z.cash/technology/paramgen

The main criticism by the researchers seems to be that the process around this setup was insufficient to demonstrate security.