To be fair, the same cryptographers that pushed for NIP-44, also lied about NIP-04 leaking private keys. The "attack" they presented would require: - A way to extract an AES key from a pair of chosen ciphertexts + their plaintext (or the other way around) - At least millions of rounds of user interaction in an unusual way - A way to forge signatures that uses keys derived from the user's private key