True I fail to multiply 3 by 3 :) So it's nine bits. The suid, sticky, and sgid make it twelve if you count them -- one and a half bytes.
However if you are going to count uid and gid those then it started with 2+2+1.5 = 5.5 bytes (sounds like the count in the article I agree), but it moved to 4+4+1.5 = 9.5 bytes. Since the point was that this was something which can't be changed (and hasn't except for POSIX ACLs which are mostly ignored) I don't think that's what the author meant.
But maybe it's true. He seems to be responding to comment so he can clear it up very easily.