I wonder if they didn't read this section:

There are no entries in the certificate transparency logs for these intermediates in that period, indicating that CT-enforcing clients like Firefox, Chrome, Edge and Safari could not have been attacked.

or if they did read it, but don't trust it.