Your last point falls flat if they’re already running a public guard though.
Why?
It "falls flat" if you're using a malicious guard. But then, you're already screwed, in that case.
Because they could already be running a node that's indexed and has the guard flag.
> However, there's a second attack. The attacker can run one or more hostile guard nodes. If he can knock me off enough guards, my tor daemon will eventually choose one of his guards. Then he can identify my actual network address and directly attack my server. (This happened to me once.)
I also worry about malicious guards. For local machines, I only hit Tor via nested VPN chains. So even if I'm using a malicious guard, the attacker will just get the IP of the exit VPN server.
For onion services, I typically use VMs in dedicated servers. And so I can put at least one VPN-gateway VM between the onion server VM and the Tor guard.
You could also get all of the guards from tor's state file, and hard-code them in torrc with EntryNode. That wouldn't prevent an attacker from taking the site offline, but at least they couldn't become your guard.