The NSA is very good at math, so I'm be thoroughly surprised if this analysis was error by mistake rather than error through intent.
Which is generally known, so I'm surprised by your argument. Even if the NSA knows more than they are telling us, this doesn't result in most of us feeling less worried, as their ends may not be strengthening the public's cryptography!
Also, we still to this day do not know where the seed for P256 and P384 came from. And we're using that everywhere. There is a non-zero chance that the NSA basically has a backdoor for all NIST ECC curves, and no one actually seems to care.
I have no reason to doubt that a lot of math has been made more difficult than necessary just because it is known to give a subtle military advantage in some cases, but this isn't new;
In my mind's eye, it's cooler: it's like, you render the ciphertext as a raster image, and then "de-lattice" it to reveal the underlying plaintext, scanline by scanline.
but i can imagine, based on my own ignorance, creativity, and lack of correct understanding, would be some kind of factorization.
as I think while trying to better know what's a lattice, I imagine a lattice like a coordinate pair, but instead of each coordinate existing on a line, they exist on a binary tree (or some other directed graph explored from a root outwards without cycles)
which means you have two such binary-trees (not necessarily binary, but it's just easier to work with them seemingly)
and then you combine these into ONE lattice. so then, to de-lattice means to recover the binary trees.
but when I say binary tree I'm thinking about rational numbers (because stern broccott trees)
Somebody would leak or steal that as it would be a GIGANTIC leap forward in our engineering skill at the quantum level.
Getting more than a handful of qubits to stay coherent and not collapse into noise is a huge research problem right now, and progress has been practically non-existent for almost a decade.