This is the question I had about this. The reason this design works per the article is that the GPU memory is inaccessible to the OS, so the decrypted content cannot be stolen.
With a unified memory architecture, is the shared GPU memory inaccessible to the CPU?