Also note that in the review of the ecosystem the Matrix developers, i.e you :), also discovered further clients vulnerable to variants of attack #3 and assigned CVE-2022-39252, CVE-2022-39254 and CVE-2022-39264.
While I'm here, yep those seem fixed also as far as we can tell: https://nebuchadnezzar-megolm.github.io/#remediesfixes