They call that out specifically at the end, CPUs with their own embedded TPM aren't vulnerable to this kind of attack as all the communication occurs within the CPU itself.
I know this attack doesn't apply to commonplace embedded TPMs.
I think the label of "security theater" doesn't apply to commonplace embedded TPMs.
I can find lots of current motherboards with a chipset on them, even specifically calling it a PCH.