That's the problem with most customer support where the employee doesn't have technical knowledge and only know how to solve common problem.
not just the customer support employee but the owners sometimes are just as bad. you'd be surprised to see how many of these companies that keep showing up like mushrooms have no idea what bitcoin even is. they pay minimum amount to a newbie developer to set things up for them and that's about as far as their efforts go!
I know. To make things worse, usually there's no documentation which makes migration become extremely difficult.
I'm not sure how that company survive when malleability attack happened few years ago 
I don't think it's in the customer's interest to conduct a malleability attack when using a service which accepts only the first seen transaction ID as valid.Looks like you forget about malleability attack performed by someone which attack every single transaction on mempool.
See https://bitcoinmagazine.com/articles/the-who-what-why-and-how-of-the-ongoing-transaction-malleability-attack-1444253640