The site doesn’t really explain quite why modern browsers still happily execute javascript from inside an .svg file? It seems like a trivial thing to patch.

seeding boobytrapped .svg files

Oh well, some lines write themselves

Gotta have my print-quality vector porn!

Boobytrap sounds like a slur.