I note that Maxwell’s original description of this protocol says:
This leaves open a side-channel that has exponential cost per additional bit, via grinding the resulting R’ mod order. Using the FEC schemes that I’ve discussed before it’s possible to leak a message of any size using even a single bit channel and enough signatures… But it eliminates the obvious and very powerful attacks where everything is leaked in a single signature.
This is clearly less good, but it’s only a two-move protocol, so many places which wouldn’t consider using a countermeasure could pick this up for free just as an element of a protocol spec.