They are not really saying it isn't immutable....

The hand-wavy report is mostly deceptive fluff. They were funded to write FUD by government intelligence. Their conclusion is mainly to centralize the system, to protect it from centralization.

Really, most of their points are outdated, inaccurate, of deceptively spun/overblown.

Mining pools with TLS supporting Stratum servers have been the norm for a long time.

People have known PoS is insecure since the start.

51% attacks are conceptual and not really very feasible, as we were previously discussing. They mostly just hurt trust in the system, tanking the value, then get reversed and fixed. Blockchains are immutable, even 100% attacks can't confuse your node to change history; they can only censor or forge new transactions.

Sybil cost in meaningless to a trust-less system and so is the laughable suggest solution of centralized "trusted" third parties. Only a Sybil attack of a full eclipse can do more than simply deny service. It is a non-issue.

The scale-free section is full of misunderstandings and faulty logic. No, there is a peer gossip protocol, so there is largely no need for allowing incoming connections. A few percent is all that is needed to help new installations discover peers without relying on centralized peer sources.

They naively assume they can analyze nodes. Reported node versions are easily forged. Many nodes appearing to be hosted on those cloud servers are likely just a cloud DNS.

The fear that different versions of wallet clients exist...and that a few people have control over the "reference wallet client implementation" code....yet they miss that Bitcoin is not a software; it is a protocol. The more different code bases, the better.

Their main real concern highlighted was temporary denial of service through a couple of avenues.