This is not true: OP_RETURN has been uncapped at the consensus level since its introduction in 2014, the attack vector was open all along and everyone technical knew about it, including the press.
You are actually contradicting yourself by affirming both "OP_RETURN is not the only vector" and "v30 ...