The paper trains a model that a. requires training data in a specific environment. Meaning, to deploy this tech, you need access to the space first to train this model. b. once trained, will not transfer its knowledge if routers are moved, or setup is deployed in a new area. c. training was done with just a single person moving. multiple people moving was not evaluated by this tech/probably harder to achieve. With that in mind, I think privacy-invasion capability of this technology is exaggerated by some comments here.