1. First, a threat actor needs to own at least the 30 largest routers on the network

The top 30 nodes by capacity encompass something like half of network cap - remember, thats not just outbound sats but inbound sats. They need a significant portion of the network committed towards them

2. They then flood the network with htlc's and make them unresolvable, triggering FC's
3. They need to keep the btc mempool congested w/o clearing at over 10s/vb for at least 2 weeks

This is because a default configured watchtower defaults to 10s/vb and default TLV's of 2 weeks on FC's. If they can prevent you and your watch tower from broadcasting the closing state, they can publish it themselves, ascribing themselves the balance of that channel.

4. The threat actor hopes he gains more BTC from vulnerable node ops than he does from triggering justice tx's from good node ops. You could even take into account the value of inbound liquidity and the assumed loss of fee revenue bc they were running a huge router network!