Old paper and fairly sure this vulnerability was already patched, but correct me if I'm wrong

Doesn't affect hidden amounts or addresses either.

So this is what they would theoretically know:

Alice sent ? to ?

And it is harder than you might think to sustain this kind of attack. ArticMine goes over the details in new Monerotopia starts 1:36:00 :