alnicol
The smartphone aspect is a bit of a red herring. He used an smartphone with an external radio. The same exploit could be done using a laptop, a tablet, or just a box of electronics.
Given that this is 'spoofing' radio messages, there's also absolutely no reason why an attacker would be on the plane. Easier for them to sit on the ground and do it remotely.
Still, it's an interesting article/presentation and nice work.
Both ARINC and STIA allow messages from various devices including pagers to be uplinked as an ACARS message. See the slide 'Access Methods'. There is no need to have an ACARS radio frequency - just the capability to send a malformed message. However, Tesa also showed he obtained the ground station capability too by buying systems on ebay.
There are multiple ways this can be exploited. It makes sense to be cautious.