While the title refers to "arbitrary data," users can hide whatever they want within Unicode characters, though this seems limited to text. This is different from, say, "arbitrary code execution ...

A malicious package in the Node Package Manager index uses invisible Unicode characters to hide malicious code and Google ...

The Unicode standard defines the binary code points for roughly 150,000 characters ... That means the behavior can't be used to reliably smuggle data or instructions. However, Rehberger said ...

These are characters which can be built from multiple glyphs, but they also have a pre-built Unicode point. There are also ligatures that combine multiple characters into a single code point.