Interesting read.

I would have thought this 998-999 multisig to be bigger than 0.1 MB, no? Does anyone know how much it cost?

Just as a comment, is the default time one has to broadcast a penalty transaction not around 2 weeks or so? In which case, even non-technical users would have had enough time to respond to a malicious actor provided a patch was provided to them in due time?