Chain length is measured by the sum of the difficulty of all blocks, not the mere number of blocks. Mining at a lower difficulty will therefore produce a shorter chain, even if it contains more blocks.
This.
In addition, the process for computing the difficulty can be checked by a node that receives a block with a new difficulty value. If the hacker arbitrarily lowers the difficulty of the blocks he mines, then that difficulty value will be found to be incorrect by nodes that he sends the blocks to and these blocks will be rejected by the network.
