He said he was running LN nodes for a couple of years, never had an issue. The problems came in once he connected to BTCPay and lnbank, I believe, giving them full access.

This isn't LN problem, this is a problem of custodial plugins, IMO.