What do you mean when you say "lured into an attack chain"?  If the false chain is does not have more chainweight than the true chain, then you would have to prevent the checkpoint server from accessing the open internet, a feat that becomes very difficult if we implement multisig.  If it does have more chainweight, then it is by definition the true chain, so broadcasting it is not an issue.

Isolating the checkpoint server from the open internet is similar to isolating a single large minter.  You really can't do limitless damage, as all transactions and blocks have to be cryptographically valid.  The maximal disruption is probably along the lines of causing a fork between checkpoint enforced and checkpoint unenforced that will reorg to the heavier chain when the checkpoint server sees the open internet again.