Concept of "origin"
The "same origin policy" can only be as robust as the definition of an origin is. The origin is the entity the browser believes it talks to.
Quoting the paper:
Next, by tampering with network traffic the attacker (...)
The idea that you can modify at least some server answers makes the origin of these vulnerable requests meaningless ...