I agree that it should be verified, but given that it was published on Nature gives hope that it will be reproducible.

I would assume it is not, UE has some strict rules about fair competition, but the problem is to prove that in the court. Newag is arguing that the hacked and reverse engineered code is not the code they have. Probably in the meantime they run the cleaning protocol in the company…
But company’s public image will hopefully suffer from the story, maybe at least they loose in eyes of potential buyers.

https://badcyber.com/dieselgate-but-for-trains-some-heavyweight-hardware-hacking/ link for very detailed description of this story, highly recommend the read!