ok, so the actual Lightning devs seem to be saying that real-world instances of the exploit have happened, not just a bunch of whiners from competing cryptocurrencies. That's not to say that someone couldn't be deceiving the devs, you have to take these claims on trust, as it'd be simple to falsify any evidence. But I guess that must be the underlying point: some person who the Lightning devs genuinely trust have reported this to them.