Unfortunately, I just cited one pretty harmless example that was easily fixable because it was my recklessness and ignorance about how Ledger checks all the generated addresses. This of course could be corrected with Electrum gap limit increase, but in the case of OP, something made a transaction which he did not approve, and for which he could not determine whether it was a hack or a change path attack.

The only positive thing about this is the possibility that it is an address that is possibly part of a wallet, but as far as I understand from the description of the attack, finding that address is extremely difficult.