Custodial lightning is always a vulnerability.
ZBD blocks depending on regions. Could be that this person was in a state not supported.