Significance of y-coordinates in ECDH public key exchange
The paper you reference mentions that although both coordinates are sent, the protocol only requires the x-coordinate to be authenticated and validated. This means that the y-coordinate is free to be manipulated in implementations that do the bare minimum. As mentioned in a comment, &quot;poor programmers and bad quality testers will not consider [this vulnerability]&quot;.
Sending only one coordinate makes it less likely for an implementer to make a mistake. With only one coordinate, it's impossible for the second coordinate to be manipulated, and it's significantly harder to force someone to use a point not on the curve. It's easier to test that given a value, a function always generates a valid point or throws an error than it is to test that a protocol works correctly end-to-end for all possible inputs.