If the attacker has 2/3 of the entire stake then the only option is to manually coordinate a fork to a chain without his censorship, allowing protocol penalties to run its course. A direct analogue of an asic PoW fork in case of a sustained attack.
>and thereby convincing victim nodes that he in fact is the victim of false slashing because the victims will only discover the slash-claims much after the attackers "valid" blocks?
It's not possible for 'false slashing' to occur, because slashing requires presenting conflicting votes.
>Isn't the slashing mechanism also reliant upon mere hope that the network topology randomly happens to be in favor of non-malicious peers?
topology doesn't matter in this case, 2/3+ consensus is asynchronous. 2/3 of stake is required to finalize blocks, so the attacker would finalize his own chain without slashing.
There are some ideas about 99+% proof consensus which rely on topology and nodes being online (which means they can observe that censorship is happening) but it's not currently implemented. Eventually I expect it to happen, making attacks a practical impossibility, by coupling asynchronous 2/3+ consensus guarantee with synchronous 99+% guarantee, effectively automatically coordinating anti-censorship forks.
https://vitalik.ca/general/2018/08/07/99_fault_tolerant.html