Being decentralized does not prevent them from making the job of an insurer.

Nexus Mutual just told on Twitter that since it is not a smart contract attack, they're not going to pay.