I think they are taking advantage of the low on-chain fees to relocate their liquidity and arbitrage with routing fees. They could be probing the victim's channels and detecting that there is liquidity available to do so.

They might have so much of demand from some of their peers that it is profitable to open a new channel and use it purely to rebalance others.

However, I do not think this attack makes economical sense in a different fee environment or to medium-sized nodes, as you would need to open a channel with the almost the same liquidity as the entire node.

As far as the fees goes, they are probably setting a high fee rate to avoid having the liquidity locked in their side of the new channel. Given that the victim node is considerably smaller, this is quite possible.

To overcome this, I think the best approach is to set initial fee rate to something like 500ppm and then gradually lower it as you see the channel is not routing, this will make the operation longer or more expensive, and will give you some sats to relocate your liquidity after the "attack".

Another option, as the post says, is to block incoming channels based on some policies. I have created acceptlnd specifically for this, there are multiple parameters that you can use to decide whether you are happy with the new channel or not.

I don't think it is bad to have a defined set of requirements for accepting new peers, your liquidity and time are limited, so you may not have it with certain peers that you know or consider they won't perform as well based on their metrics.