If I'm not mistaken, won't this still be vulnerable if user passes same token address twice in an array, with the same flash loan amounts (full balance, 0)?

In other words, it's not just double-entry ERC20s that would cause this, right?