The interesting part here is how several small validation weaknesses have to line up before the deserialization issue becomes useful. The Unicode soft-hyphen bypass and the loose != comparison are good examples of why validation needs to match the actual application logic.

The duplicate-property trick is probably the most interesting part, since the application's regex sees role=request while PHP ultimately ends up with role=admin. It shows how validating a serialized representation without considering how PHP will interpret it can be dangerous.

Overall, the write-up does a nice job of showing that the vulnerability wasn't just unserialize() itself. The surrounding validation checks also played an important role in the exploit chain.