I don't think your #2 is a concern as OHTTP uses HPKE (https://blog.cloudflare.com/hybrid-public-key-encryption/).
Note that in addition to normal HPKE we're also adding a Date header to the encrypted headers and padding the contents.
My cryptography education is rather superficial, so I might be missing something.