Zero value scam/attack and mitigation

Hello, I read about this potential scam. etherscan says: "This is a zero-value token transfer initiated by another address". I look at address and they seem to want to mimic correct address by having a few letters/numbers being similar at the beginning and end.

My question is: if someone fake-initiated tx from my address using their address, who pays the fee? I hope it wasn't me.

Additionally, i am surprised that devs did not put a stop to this already.

the problem and 'solutions" are described here: https://cointelegraph.com/news/scammers-are-targeting-crypto-users-with-new-zero-value-transferfrom-trick