Interesting observation from that paper I don't remember ever seeing before:
Another slightly related security issue also arose from the fact that k has to be chosen by the signature algorithm. If two values k1, k2 in two different signatures have a known linear relationship k2 = ak1 + b with a, b ∈ Z, the private key d can be extracted from the two signatures without the knowledge of the values k1, k2, since it results in two linear equations with only d and k1 unknown.
It means that two R values don't have to be identical (reused) for their private keys to be breakable, it's enough for them to be "close" to each other, so that R
2 can be found adding G to R
1 relatively small number of times, few million for instance so it would be implementable in practice to check the neighborhood of every R value ever used against the complete set of R's. I know that two R values in theory should not ever be close to each other if RNG is decent, but we see in practice that not only they are close but often identical.
It doesn't have too much to do with closeness. There is a linear relationship between any pair of two numbers in the Z_n (with n from Bitcoin's secp256k1 curve). The question is whether you know it. Easier k is much easier to break, because it results in identical r appearing in the blockchain. Anybody can detect them immediately. But for an evil programmer who manipulates the generation of k, there is much more potential to leak values, without having obvious appearances in the blockchain.