You're right. As sibling comment says, in many cases, the attacker would attempt to pay the fee with funds from the address they were robbing. Though some token

You're right. As sibling comment says, in many cases, the attacker would attempt to pay the fee with funds from the address they were robbing. Though some token transfers might require the attacker to add their own funds. I was mistaken about that part.