rc4 description of correlation between keystream and key

[trackpick]

"For an ideal stream cipher, the first byte of the keystream should tell me nothing about the key. In RC4, it gives me some information about the first three bytes of the key. The latter seems less serious: after all, the attacker isn’t supposed to know the state of the cipher."

If the attacker knows the plaintext and the ciphertext, they could XOR them to produce the keystream, right? And therefore learn something about the key per the above (but without knowing anything about the internal state of the cipher)? If so, that seems exploitable and worth mentioning.