As far as I can see, Heise assumes that just because there's a link to the URS, the domain is no longer under someone else's control. I can't find any confirmation that the URS has actually been invoked.

If I were someone trying to spy on specific users, or collecting data maliciously, I would host this HTML on my own server to confuse journalists.

Currently, every subdomain (up to any level, as far as I can tell) resolves to an IPv4 and an IPv6 address. I doubt ICANN would do this for seized domains.

The domain is still not owned by AVM so it's still hijacked.