If one connect a keyboard and mouse to the phone, those are usable right away, without approval of the user, as long as USB data is enabled and phone unlocked. Any USB device, including a public charger, can pretend being a keyboard and mouse, and thus can do anything on your unlocked phone you can do yourself, including installing or replacing apps with malicious versions from the web, screenshoting, and copying out all your files and data.
From only reading the abstract of the paper above, it seems they are exploiting this, and used it to enable the data transfer, which is always disabled by default. A recent update made you need to scan your fingerprint to enable data transfer, but this won't prevent them from copying out all your files, or installing malicious apps. They can just upload them to a website instead, or download the APKs from a website instead.
Charging cables without data links are the only safe way, or the "Charging only" mode, but that latter may be easy to forget to enable.