The answer to my question is probably related to why you're wrong there: the paper's first reference is to an ETH research blog post about optimistic rollups. Arbitrum is just one of the two popular implementations of that, I'd forgotten.

The main idea is to use challenge-response as fraud proofs.