That is my understanding as well. Since Trinity downloaded code (a .js file) and executed it, and the attacker routed that download request to his own files, Trinity then executed some arbitrary javascript code created by the attacker.

So IMO I don't see why this must have stayed contained within Trinity at all - running arbitrary code on users' machines usually means game over.

That said, this is the absolute worst case we're assuming here.