Do we have to trust at least one DNS seed?
What you are saying is correct.

I'll quickly elaborate on why these hardcoded dns seeds are required. The attack you mention is called "peer list poisoning", a strategy that can be used to segregate someone from the network. There are two main types of peer list poisoning:


Dishonest nodes: the attacker poisons your peer list with real nodes, but malicious ones. All of your transactions would always be forced through these nodes.
Void nodes: the attacker poisons your peer list with non-working nodes, a strategy often used to dismantle malicous P2P botnets.


You may think the DNS seed require an element of trust but it doesn't. There are ways to verify that a DNS seed is honest: if you run your own 24/7 Bitcoin Node with the right setup then your address should be available in a list returned by a DNS seed. They crawl the whole network and regularly revisits known nodes to check their availability. DNS seeds do not return a full list, so it's not very practical.

There are alternatives to using DNS seeds, such as crawling the network yourself, or even bruteforcing IP addresses and attempting a connection.