It’s a really good question. I’d say it’s been really hard for a single attacker to actually steal funds en masse due to lack of single honeypots and isolation of funds in different channels with different counterparties. This might change as amounts get bigger, but the incentive design means payoffs should never be asymmetric like we see if DeFi (tiny effort, huge theft potential).

It’s not as hard to grief a node via channel jamming but the attacker can’t directly steal money, can just enjoy the pleasure of being an asshole for a while. Hence why lower hanging fruit attacks haven’t really been exploited yet.