As of today's patch in 1.11.0, hostile mobs can spawn in any open area regardless of lighting during a thunderstorm. My main base compound is thoroughly lit and has been totally secure for months, up till now. I have just witnessed a wide variety of hostile mobs (including a witch, multiple zombies and a creeper) spawning inside it under the conditions described. One spawned on a flat roof within the base building itself, so that is no longer secure either. I doubt if I'll be playing Minecraft again until this is fixed.