??should an attacker be certain his victim only uses a lit wallet??

well..
most people dont carry around a desktop computer when wanting to use remote/someone elses internet. so usually people are checking via a smart phone by default when they go visit someones house. so chances that the victim is using a lite wallet being very very high without attacker even having to try

..
secondly. if someone is a noob and doing their first step into bitcoin as an introduction, an attacker can sway the noob whwich lite wallet to download.
"EG to save you learning all the technobabble just download wallet XXX which is user friendly" most nobs would do it without thinking

thirdly and a good defense for victim. if iin your scenario of meeting up with an attacker. the victim has a face, location and other details which authorities can use to catch the attacker. this isnt as much the case in remote private exchanges

this topic doesnt mean that its super easy for an attacker to do it.. like advertising to scammers a get rich quick and easy.. but its just stating its not impossible to achieve and people should atleast be wary

its like debit card cloning. in quiet village/small towns that dont have much police patrols and where ATM's are scarce. the population usually end up using the limited atm's more. and its stuff like that which card cloner love. secluded location to give them time to insert the card skimmer without being spotted and knowing the footflow(usage) of atm will be high due to lack of competing atm's
hense people should be wary when using an ATM

its like getting a random phone call from an accented voice saying they are technical support and that you have a virus and need to download their software.. just be wary..

even of chances of being scammed seem low. doesnt man saying something is impossible to happen should be said, nor should it be said to not be aware of the potential risk even if chances are low