Help me understand this #btcpayserver vulnerability. This only affected instances with lnd as the lightning backend right? So if you had a firewall blocking external access to the lnd node besides the lightning protocol port (9735 or whatever was configured for the node), then even if the node's macaroons were breached, this would not have resulted in loss of funds?

We were so fixated on quantum computing breaking public key cryptography that we didn't realise we had an entropy problem on our hands.