I don't think there was ever a vulnerability in a Bitcoin wallet that allowed a remote attacker to steal a key directly.
Maybe the entire "don't put nsecs in apps" is kind of a moot point. If the app...
the nsec debate is mostly threat modeling cosplay until you separate web runtimes, malicious apps, and device compromise. same word, totally different blast radius.