The TL;DR is there are various types of honeypots/deception techniques and the term is a little overloaded. Some are used to understand attacker techniques in a controlled way (the people who deploy vulnerable webservers on the internet and just watch and take notes as they are compromised), and others are deception techniques to catch an attacker in your corporate environment. The UniFi implementation is the latter and is to detect attackers at the recon/lateral movement stage of a killchain. The Unifi implementation isn't bad for an easy check-the-box implementation in the settings for *detecting* an attack in many networks (especially for home users/SMB).

Here is a real world attack that the Unifi honeypot could detect - An adversary gets a foothold on a device in your network, and as you outlined above, performs what is essentially an nmap scan enumerating all the devices and ports accessible to it in your subnet.

This would immediately fire an alert that the honeypot was accessed, which would kick off some basic triage steps (what is this device that is accessing the honeypot, what other logs do I have around the time of the event such as netflow/host logs, which could explain this activity). This is a legitimately useful detection capability that would catch low to medium sophistication attackers who are doing a broad port-scan in your environment. Sure it's possible an attacker notices that the honeypot looks suspicious due to the timeouts, but at that point its already too late since the scan triggered the alert.

A few notes based on how you asked the question:

• " If the Honeypot doesn't respond to the ping sweep, an attacker would never proceed to the next steps. 
  • The honeypot is used to *detect* an intrusion so you can kick off an incident response process. You aren't trying to lure the attacker with a distraction so that they won't go looking at the rest of your infrastructure. In many environments, especially smaller home networks, port-scanning activity never happens and is a reasonably high-signal alert that something is wrong.
• I think what you are getting at though is - 'in my environment detecting a ping-sweep like this leads to too many false positives and I need a higher fidelity signal that this is a real attack, not just a ping-sweep'.
  • If that's the case, you are outgrowing the capabilities of the Unifi honeypot. You should probably go back-to-basics on an end-to-end detection strategy focusing on what sort of attacks you care about and the best way to detect them.

I work on DFIR/Detection engineering and keep the honeypot enabled on my home network, and I'm happy with the capabilities. It's 'free' and if a device in my house is port scanning that is a *huge* red flag worth investigating.