Is it legit?
No, and you hit on the reason - the algorithm converts the message into a series of 16 values from 1 to 128, and then signs based only on that. That's a total of 112 bits; actually, it's somewhat worse than that, as the algorithm they use to convert the message hash into the series of 16 values will generate values that always sum (mod 128) to 64;. That means that with a valid message/signature pair, you can find a second image that translates into the same first 15 values [1] (and thus would be a valid message for the same signature) with an expected $O(2^{105})$ effort. Even worse, because the translation doesn't involve any randomization, you can expect to find a collision (and then ask one message to be signed; the second message with that same signature would be a forgery) with an expected $O(2^{52.5})$ effort.
The paper also makes a series of erroneous statements; here are the ones that jump out to me:
They claim that "Other type of OTS/FTS schemes (except WOTS and its
variants) are not capable for allowing computation of the
public key from the signatures unless a huge additional set
of information is provided to the verifier."; this is incorrect. For every every hash based signature scheme I've seen, the verification process was essentially "take the message, the signature and possibly some small amount of data from the public key, compute a series of hashes, and if the result matches what's in the public key, you win". That is, all you need to reconstruct the public key is this "possibly small amount of data", not "a huge additional set of information". A minor point, except that they emphasize this repeatedly.
Their evaluation, which consists of comparison with some selected other hash based signature schemes (but nothing with a large W parameter); however they insist that they run the competitive schemes with an unrealistically large hash size (n value) - they note that their scheme (which does have a large W parameter and smaller n value) results in smaller signatures; not surprising when they put their thumb on the scale so heavily.
They also state that "Finally, NOTS has achieved all these reductions
in key and signature sizes without compromising the security level"; even though a glance at their table shows that they claim NOTS has significantly lower security level (not counting the point I made above about how it doesn't even achieve that).
As for their security proofs, well, that consists of algorithms they provide which takes a forgery and generates a collision; however going through the algorithm shows that, even when given a forgery, it can fail (that is, not produce a collision); hence it is invalid as a proof.
[1]: Once you first a match on the first 15, you'll always get a match in the sixteenth.
