The Lightning Paper v0.5.9.2 says that CSV "would permit further abilities, including allowing a stop-gap solution before a more permanent solution for resolving transaction malleability. A future version of this paper will include proposed solutions."
This means that Thunder is still vulnerable to malleability attacks since it relies on CSV as a solution.
Since the Thunder readme does not mention malleability fixes as a TODO point, I guess the Thunder authors considers it fixed.
The cited Lightning draft is from January.