One more thing I could imagine is the positive rail going negative if the negative rail came up first and then overvoltage, breakdown and overcurrent.
But realistically, the wimpy wires are the most likely culprit indeed. And of course, if their datashit is to be believed, the chip is capable of sourcing more current than it can survive 
But again, realistically, the wires fuse at 0.5A, the chip smokes at 1A, the spec says 1.5A and somebody inevitably sells it as a 5A part on eBay.
'317 does not have a ground pin, if the IC fails there is no overcurrent other than it what it can push into the load by overvoltaging it. The ADJ pin resistor limits that.
But... in a bench power supply the ADJ pin potentiometer smokes (add a polyfuse) when you dial it down wondering why the output voltage is too high. Then, when you short the output, the IC finally melts.
EVVO Semiconductor screwed up twice - defective packaging, and defective test. No biggie in china, this is par for the course.
Do they have an independently-audited quality system in place?
Shame on Digi-Key for letting anyone into their supply. For all that markup of theirs, they have no vetting process it appears.
LM317K TI is $1.00 on LCSC verses $6.61 from EVVO on DK.