BOLT #7: Can receiving node requirements in channel_update message give rise to malicious attacks?
According to my understanding the receiving node will first check the signature of related the dsha256 of the entire message before verifying the timestamp and not check the remainder of the message if the signature is invalid. So if other fields apart from signature are changed, then the signature will not be valid (as the message has changed) and the node will not process the message further.


This is the correct understanding. It is stated earlier on in the receiving rules. Although the client implementation must read at least the chain_hash and short_channel_id from the message in order to retrieve the public key associated with that channel from its storage (if it exists), in order to perform the signature check.


  
    if signature is not a valid signature, using node_id of the double-SHA256 of the entire message following the signature field (including unknown fields following fee_proportional_millionths):
    
    
    MUST NOT process the message further.
    SHOULD fail the connection.
    
  


The checks on the timestamp and other field are performed only if the signature is valid, and the purpose of the check is to prevent spam from a valid signer. It is assumed that more than one channel_update in the same second is a DoS attempt, and therefore, the node responsible for signing such messages ought to be blacklisted.