What is the "unknown attack" the reviewer is referring to?
The reviewer did not say "the unknown attack", but "in front of unknown attacks". That refers to no attack in particular. Much like a reviewer of a math paper could tell, without thinking of a particular $y$: "the argument that $p$ is prime is unconvincing, for it fails to show $\gcd(p,y)=1$ for hypothetical $y\in\left[2,\left\lfloor\sqrt n\right\rfloor\right]$ with $y\not\in\mathbb S$" (where $\mathbb S$ is a set defined in the paper).
I read the reviewer's argument as equivalent to: the existing analysis gives no proof that the claimed IND-CPA security follows from the difficulty of some assumed-hard problem.
That's what so-called security proofs are when it comes to encryption. Since about the last decade of the 20th century, such proof is considered necessary for proposing a new cryptosystem or protocol in a serious peer-reviewed crypto journal or conference, with few exceptions. These exceptions include block ciphers, hashes, or similar low-level primitives: for these, we still examine known attacks, and prove they do not apply, preferably with some quantitative assessment.
For all other cryptosystems, modern arguments against unknown attacks are on the tune of: Assume a PPT algorithm $\mathcal A$ that breaks IND-CPA security of the proposed system. (..) Hence PPT algorithm $\mathcal B$, using $\mathcal A$ as a subroutine, is able to solve the well-studied smurf problem with non-vanishing probability. Perhaps that smurf problem is: attack of AES with random key under IND-CPA.
If such security reduction is missing entirely from a paper, adding it will be a major rework; or sometime, impossible.
Up to the early 1990s, practice allowed to claim security without proof, or even without a clear definition. It was common the claim was disproved. For example, El Gmamal encryption in $\mathbb Z_p^*$ turned out to leak one bit about the plaintext. Countless attacks where found on RSA encryption and signature schemes. Crypto was then proverbial for it's break and fix cycles, much like bridge design used to be. Fortunately, these times are over when it come to crypto designs in IACR publications. That's still the norm for implementation, some standards, and less than recommendable publications.
My favorite example of why we should not trust security claims based on repelling existing attacks is the ISO/IEC 9796:1991 signature scheme, withdrawn 2000. It was AFAIK the first official standard for RSA signature, and carefully justified by Louis Claude Guillou, Jean-Jacques Quisquater¹, Mike Walker, Peter Landrock, Caroline Shaer Precautions taken against various potential attacks in ISO/IEC DIS 9796 “Digital signature scheme giving message recovery”, in proceedings of Eurocrypt 1990. And then, in 1999, that scheme was broken by Don Coppersmith, Shai Halevi, and Charanjit S. Jutla extending an almost working attack by Jean-Sébastien Coron, David Naccache, and Julien Stern; and independently by me using a technique a child could apply: all there is to do is find two different paths across this maze and collect the node values.
¹ I thank JJQ for having taught me multiprime RSA (then uncommon and perhaps unpublished) and using the Chineese Remainder Theorem for that.
