High level answer: Lightning transactions happen off network and only "sync up" once in a while. In a lightning transaction, only the two individuals transacting know that it has happened. But in an on-chain transaction, that info is public.
Other person node who would lose money if this happend can publish the original transaction that is construscted in a way that the attacker would lose all his funds.
So attacker could potentially do this but if they get caught they get punished for losing everything and they get caught if the other side node is online when this happens.
There are also watchtowers that can monitor the network for hacks like this