I'd love to see what they submitted to their IRB to get the determination of no human subjects:

It had a high human component because it was humans making decisions in this process. In particular, there was the potential to cause maintainers personal embarrassment or professional censure by letting through a bugged patch. If the researchers even considered this possibility, I doubt the IRB would have approved this experimental protocol if laid out in those terms.

This research is not exempt.

One of the important rules you must agree to is that you cannot deceive anyone in any way, no matter how small, if you are going to claim that you are doing exempt research.

These researchers violated the rules of their IRB. Someone should contact their IRB and tell them.