Many of the services I used do this and some of them are long-established companies. What I noticed is that those services either generate a new unique address for each new deposit or accept 0 confirmation transactions. I don't remember facing this problem when the deposit address is permanent.
In fact it makes sense if they have tons of addresses to monitor and they consolidate their inputs regularly.
Monitoring deposits based on the TXID is not the most efficient way about doing it. It would just cause unnecessary delay for the user and it would be a headache for them if the user decides to RBF due to low fees and whatnot.
I don't think it's in the customer's interest to conduct a malleability attack when using a service which accepts only the first seen transaction ID as valid.
It would be annoying for the company to handle hundreds of support messages regarding uncredited deposits due to the malleability issue.