Actually, the lock-time affects the party that closes the channel. Thus, if an attacker compromised the exchange and closed all channels unilaterally, the funds going to the hacker would be the ones that are locked, and the user funds would become available immediately.

The exchange could even mitigate the attack to some degree, by giving the users the breach remedy for the published state, allowing the users to claim the funds instead of the hacker.