Notwithstanding the comments here refuting the vulnerability, this is an informative and potentially useful article. I learned some stuff.

FWIW, my fresh install of Fedora 38 uses argon2id as the KDF.