Would love an ELI5 on this.

I don't have a sense of what exactly this guy did wrong. My understanding was that BTCPay allows vendors to *receive* payments. How exactly was it able to swipe his funds?

The extent of my current Lightning involvement is running an LND node with two open , outbound channels, both of which are controlled by Zeus.  Am I vulnerable?