Did it say what size RSA the researchers were able to crack?
They weren't able to crack any size of RSA key.
The largest number they were able to factorize was 48 bits. The minimum recommended size for RSA keys is 2,048. They weren't even close, even to older 1,024 keys which are still in circulation. The RSA-100 number, which has 330 bits, was factorized in 1991, and can be factorized on a modern computer in a matter of minutes. 48 bits isn't even close to this number either.
The whole thing is a clickbait nothing burger. The difference between 48 bits and 2,048 bits really can't be understated. It would be like newspapers in 1969 announcing we had colonized the solar system after landing on the moon.
and only addressed that have spent funds are vulnerable
That's not quite accurate. There are also millions of coins in old style P2PK outputs which are vulnerable, and since taproot no longer hashes public keys then coins in P2TR outputs are vulnerable as well. Not to mention all the public keys which have been revealed through other means, such as SPV wallets, watch only wallets, payment processors, signed non-transaction messages, etc. And obviously the public keys which will be revealed as soon as a transaction is broadcast. Relying on the public key being hashed is a poor defense against quantum computers. Rather we will implement some quantum resistant scheme when the time comes.