Disclosure: Critical vulnerabilities fixed in LND 0.19.0

That’s correct. The protocol provides the max_htlc_value_in_flight_msat channel parameter to limit this. But LND’s default behavior is to impose no limit. And AFAICT, there’s actually no way to override that default behavior in LND.