Tbf as someone with an infosec background, I would have probably written just about the same.

Pickle payload is a red flag precisely because pickle is not a safe serialisation format format when taken as untrusted input, here the input was trusted but it's still giving someone en easy escalation path (exactly what happened)

And most people would assume the whole cookie payload would be encrypted if they saw just a binary blob, and not realise you can fully read it if it's just signed

But, yes, the post was probably edited by an LLM, as is pretty much everything else you read online these days.