To answer the question: The website admin must be in on the exploit.
The encoding technique is there to obfuscate the actual exploit scripts, thus flying under the radar from current detection methods. It still requires HTML/Javascript to be on the webpage in order to decode and run the exploit.
That is to say, if I had encoded an exploit into pleasedontrunthis.jpg
, I (the web admin), would still need to open the image like so:
<script src="pleasedontrunthis.jpg">
To answer the question in the title: Not really.
This is an encoding technique, not an exploit. It requires the would-be attacker to serve malicious Javascript in order to... server malicious Javascript. This technique could provide sufficient obfuscation to hide itself from both automated and human scanners for a potentially longer period of time than exploits which offer huge walls of text simply by hitting F12.
In practice this means that someone could hack a website (ie, through a Wordpress vulnerability), and deliver a silent exploit that would take longer to find.
In reality, if an exploit in the toolkit was capable of pwning your machine, it would have most likely pwned your machine either way. The reality being that not all malicious code is going to make itself glaringly obvious, so there's always an inherent risk when deciding to allow it.