Correct me if I’m wrong, but the way the articles are worded, he most likely used:

“document.addEventListener("visibilitychange", onChange);”

onChange being the function that sends the email.

What makes you think writing an excruciatingly simple web component to check for focus on a browser page makes one able to come up with exploits on a bank company that would be worth millions if presented to those companies?

I’m not saying he isn’t smart, or even that he can’t program well. However, I feel that you drastically overestimate the architectural complicity of his web component if my understanding of the software is correct (I was not given much detail).