No support to all erc-20, you can only send and receive eth, is a feature they should implement but you can myetherwallet with ledger and protect your private key.
The vulnerability is a Man-in-the-middle attack, basically all systems are kinda vulnerable with that, is not a specific vulnerability on ledger, always double check the address and you good :)
Thanks for the comment