It shows. Sampling at 200Hz means your masimum detectable frequency is 100Hz, per the Nyquist theorem - that'll capture ~40% of the typical male frequency range (fundamental only - not enough for harmonics or formants) and little or nothing of the typical female frequency range. I question the claimed 65% success rate, and would like to know a lot more about the experimental conditions before I'd be inclined to accept it. I do enough synthesis to know what that sort of sample rate sounds like without having to test, and the short answer is 'awful'. I can see possibly getting numbers out of it when the phone is held up to one's head but only in perfectly controlled environments. For contrast POTS bandwidth is 300 to 3400 Hz.
Or if an app really needed to access the gyroscope at high frequencies, it could be forced to ask permission. “There’s no reason a video game needs to access it 200 times a second,” says Boneh.
I think it's quite plausible that people might be able to detect a lag greater than 5ms in the right game. That's around the envelope for involuntary variation by professional drummers.
Plus the 100 Hz figure is optimistic. I dunno what kind of anti-aliasing these things have. If none you get an aliased signal and with a low order filter the practical maximum frequency detectable would be even less.
I saw a talk on this recently by Prof. Bill Freeman, a co-author of the above work. The visual mic idea is based on a general technique for amplifying small motions; the motions here are the tiny movements of the bag.
The more generic idea is here: http://people.csail.mit.edu/nwadhwa/phase-video/
It seems like it could have applications to lots of areas.
Slightly more feasible than the last one which focused on detecting sound via image differences in high-speed (thousands of fps) camera footage, but still...
Its placement within the device will also affect the sensitivity to audio, so it will vary between device models - the article doesn't mention if 65% is worst-case, best-case, or an average.
Since it's currently so easy to get sensor data on android phones there's a fairly strong incentive for people interested in eavesdropping to do so.
It's pretty cool, anyway