As you suspect, the curse of the Shield of Missile Attraction only changes the target, so only one attack roll is made by the attacker.
Whenever a ranged weapon attack is made against a target within 10 feet of you, the curse causes you to become the target instead.
The attack has already been made, and the 16 is now against Thurin’s AC, which in your example would case it to miss. From the rules on combat (PHB, page 194):
If there’s ever any question whether something you’re doing counts as an attack, the rule is simple: if you’re making an attack roll, you’re making an attack.