Hi TravelMug, the "critical" vulnerability never resulted on any loss of funds, you can read the detailed forensic study here showing how the events an attempt to extort Coinomi in the first place: https://twitter.com/kimionis/status/1131945228506738688
As for the second link, the user never got to open a support ticket, so all we have is a report from a random person on the internet and no way to verify any of the claims. There are other reports, which have all been traced back to the user mishandling their recovery phrases. It's very unfortunate how often we see users saving their phrases as a screenshot (which promptly gets backed up on the cloud), sharing their phrases with others, or even sending them directly to scammers. We do the best we can to educate and warn users, but due to the huge size of our userbase you will find such examples online. More details about all the security features employed by Coinomi can be found here