I understand that proof of work prevents a node from creating a new version of the blockchain unless they have >50% of the hash rate, but what if the attacker is also able to intercept the victim's internet traffic?
In that case, it would be able to mine a few blocks (or if that's too difficult, start a new blockchain from the genesis block) and then replace traffic to any node on the network with traffic to their fake node with a different version of the blockchain. The victim would then not know that a longer chain exists, so would believe the attacker.
What prevents someone from doing this?