I run a cybersecurity newsletter so i find myself searching through rubbish for ages, from both a mix of mainstream media and people's personal blogs. Most of my issues lie with mainstream media which either not have enough expertise to write the story or signigicantly dumb it down so they can be applicable to a much wider audience.
The study didn't use special characters and also used the same laptop keyboard, which I would imagine significantly inflates the percentage compared to a real world situation for this to be effective.
yeah it's extremely shady business imo, especially since all the major ones are owned by the same group who then apply a similar business model to all of them.