You misread. He is saying that the multipart UAF vulnerability part of the overall exploit can't be fixed by session.upload_progress.enabled = off or any other ini option for that matter.