I love how they gloss over the security issue here. This is the equivalent of “we made a new Ajax that can call from different domains.”
Reading through the article, I don’t see the security restriction addressed at all. I expect that this gets worked on when google submits this to the w3c to be made part of html.