> what would be the most likely way for them to have done it?
Ensure Starlink hires an agent. Establish skills / access permissions. Push an update which bricks both the update system and the running system, so the satellites become useless.
> Potentially you could burn the constellation with reentry
Just put them into a spin with a strong propellant burn while compromising ground stations. Even if the fleet recovers, its lifespan will have been significantly reduced by the propellant expenditure.
Spin would be indeed the most problematic, but the Starlink satellites only have krypton hall thrusters. Very efficient but also very low thrust - you you could not actually significantly waste fuel this way even if you wanted to.
You'd need to have actual knowledge of the hardware systems and serious access to do anything interesting with thrusters. It may be possible. But just bricking the updates is likely way simpler and less protected.
You have the resources of a country to support any activity. Need computer experts? Take your pick? Astronomers? Mathematician? They have all the expertise required.
The agent getting the right access or finding the right people on the inside and exploiting them successfully without trigger counterintelligence is the hard part.
First you'd have to extract the documentation which may not be available to everyone. I'm just saying that in limited time, the purely software side of starlink is likely much less protected from both access and changes than anything to do with thrusters usage.
Ensure Starlink hires an agent. Establish skills / access permissions. Push an update which bricks both the update system and the running system, so the satellites become useless.