You might be right, I have not followed xmr closely. You might also notice that this vulnerability is unlikely to deanonimise you, but the point was more that it is a mistake they shouldn't have made. Their last audit looks fine, though it was made by a blockchain auditing company which I don't know. I don't think there is much harm in using xmr for this, groups who would be capable of exploiting vulnerabilities in this kind of project are unlikely to do so, unless an issue of national security becomes associated somehow