Then it's your choice to comply, call their bluff, or do whatever you want. I've seen people who doxxed the DMCA sender and made threats towards the sending agent (the hoster was Russian).

Though best course of action would be to comply or ignore it, don't do what that guy did, best to keep quiet than to stir up trouble.

Outright refusal or ignoring it does come with the risk of litigation (threats can accelerate it or lead to prosecution) assuming you're within their jurisdiction.

They should upload the code on an .onion page

Legally, you cannot refuse. DMCA is written such that the host must take down first and ask questions later.

Then they would sue you and could get you in prison or at least you have to pay a very large fine. Possibly millions.