@AndresFreundTec there's definitely some people looking at it, but I don't think it's had as much debate as I imagined (e.g. the tar files thing).
And yeah, there's definitely other areas of attack. But part of me thinks even the known-knowns haven't been exhaustively looked at.