You hit on my first thought. There are numerous legitimate user experience cases where keystroke by keystroke or field by field processing is beneficial. Autocomplete for address data is one I see commonly used. Saving a partially filled out form field by field in the event a user becomes disconnected and would like to complete it later is another. From a security perspective, I know of numerous tools that examine the speed and cadence of the act of typing to discern between bot entry in a field versus human entry. There is also software like FullStory that records everything client side, including mouse movement, so companies can determine exactly how people are interacting with their sites in an effort to improve the UX. And from a tinfoil hat perspective, if a user is interacting with a webpage, they should assume everything they are doing on that page is subject to observation by the page author. If the researchers were surprised by this, I fear it's from inexperience.