Has the payment protocol – which is supposed to protect against Man-In-The-Middle attacks – ever been implemented? The two main problems generally mentioned that payment protocol “BIP 0070” (Andresen, 29-07-2013) is supposed to solve are usability and protection against Man-In-The-Middle attacks. In the latter the attacker would substitute an address he owns for the merchant's address when the payment address is shown to the customer. This could result in the customer paying the attacker instead of the merchant.

Has this attack been done before? If so, how was it implemented?
Or is this just a theoretical problem?
I am not sure if there are verified reports, but I would be shocked if there were not any man in the middle attacks.

It's super simple to do. Compromise the vendors payment processing (exploit a security hole on the vendors web werver. if the wallet address is generated from a local bitcoin instance, an atacker could point the address generation code away from the vendors instance and towards their own malicious bitcoin instance... Or the malicious user could just hard code their own address in to the payment processing. Depends on how intricate it needs to be. You could even compromise the vendor by having a copy of their wallet, watching silently for a large transaction then running once you find a big haul of coins.) you could compromise their payment gateway api and have it redirect to you(or your coin address) instead of the vendors address. or if they use email: simply compromise the communication protocol (email/web support ticket/etc) and replace the merchants address with yours.

A script kiddie sadly could (and probably has) executed one or all of these methods of attack... There's a ton of ways to do it. Those are just a few off the top of my head.

Be safe. Do not try any of this! This information is posted so you get an idea of what to keep in mind.