Paypal uses TLS1.2, so I'm not sure how the attack could reveal the message, or cookie in this case?
Paypal supports TLS 1.0, 1.1, and 1.2. If your browser advertises that it would like to use TLS 1.2, then that is indeed the TLS version that Paypal will choose to connect with. If, however, your browser suggests to Paypal's servers that the highest TLS version it supports is 1.0, then Paypal will happily connect using that protocol version as well. I imagine that this is exactly what whoever was demoing BEAST did. Set their browser up so that it would only use v1.0, and not 1.1 or 1.2.