Exclusive page-frame ownership

Yes, that's what the article says at the end. But you can still place the stack pointer in the direct map in order to bypass SMAP, and then do ROP.