I think that part of the issue is that people (probably including the WG2) hear NSA and then ignore the lightweight part. To some extent the lightweightness im

I think that part of the issue is that people (probably including the WG2) hear NSA and then ignore the lightweight part. To some extent the lightweightness implies lower standard for the security margins. This is in this case compounded by the fact that WG2 had thrown out most of the truly useful NSA recommended Speck/Simon parameter combinations (things like 32b blocks) even before the current turmoil on the basis that they obviously provide insufficient level of security, which is obviously true for general purpose block cipher, but not for lightweight ("IoT-ish" ;)) applications. On the other hand I somewhat wonder what motivation exactly NSA had for trying to push these algorithms through ISO.