It was my understanding that the user had installed a version of the Electrum wallet that was not from the official source at electrum.org. (But agree - it was really difficult to identify the core issue from this string of GitHub comments.)
They were running an old official version which has a serious issue allowing the full node servers it connects to to pop up a message. e.g. "You need to upgrade - click here" - that led to the malware.
And there is no way to track down the node server that popped up this malicious message? Take it offline?
Yes, electrum.org maintains a blacklist. That won't stop a phisher that just made 16 million dollars though. Spawning a new server costs cents.