Does the Mt Gox attack constitute theft of Bitcoins or just a Denial-of-Service attack?
As I understand it (and wrote at more length in this question), the statement is technically correct but incomplete.

The result of a malleable transaction attack is that the targeted transaction (in which the victim voluntarily sent coins to the attacker) does not confirm, but an equivalent transaction with a different ID does confirm.  It is true that this does not steal any coins: the recipient gets the same coins they were already getting.

The theft occurs in the next step, not described in your statement: the attacker points out to the victim that the original transaction didn't confirm, and convinces him to resend the amount, in a new and independent transaction.  If the victim doesn't notice the attacker's equivalent transaction, he might do this; then the attacker has received twice as many coins as he was supposed to.