This is a fun article. It was also discussed at the time:

Hacking millions of modems and investigating who hacked my modem - https://news.ycombinator.com/item?id=40570781 - June 2024 (13 comments)

As per your link the actual discussion is https://news.ycombinator.com/item?id=40560010 (277 comments)

Thanks for the backfill! That's a much better link.

In that story why was the replaying of HTTP requests so suspicious? They were cleartext requests sent over the internet, anyone could have seen the path.

Just because it's physically possible for someone to passively MITM a connection doesn't mean everyone and their dog is actually listening in on it. If they were, there'd be a booming industry of leaking celebrities' scandalous DNS requests. Instead, I'd suspect that actual actors with that capability wouldn't be burning it on small-time replay attacks.