Interesting research, but with people already plugging those headphones into a portable surveillance set, and plus them using headsets (which are already microphones as well), this seems a bit chasing the wrong target?
(Assuming that the connected computer is compromised also already implies that the attacker has a microphone at their disposal, with most modern devices like smartphones, tablets and mobile computers)
For starters, the fact that RealTek is so easily reprogrammable to turn audio output into input is very unlikely just a "bug". It's a feature left their on purpose.
(Assuming that the connected computer is compromised also already implies that the attacker has a microphone at their disposal, with most modern devices like smartphones, tablets and mobile computers)