I'm a native U.S. English speaker. They both sound fine. I would prefer the second and leave out the word "had" on the theory that shorter is better.
I sense a tiny difference in meaning. I'm not sure the sentence with "had" is PERFECTLY correct. If the robber "HAD" attacked her, it suggests that the act was complete before the act of opening the door.
In these two sentences, the first definitely is correct, and meaning something slightly different from the second.
"She said that the robber had attacked her just before she opened the door to her apartment."
"She said that the robber attacked her when she was opening the door to her apartment."
WARNING--CRAZY STUFF AHEAD
There is an interesting ambiguity in the sentences. Did you notice it? It is actually an IMPOSSIBLE meaning because of context, phrase ordering, and "common sense."
But suppose: the robber attacks her on the street. She enters her apartment building, opens her door partway, starts to walk through. She looks upset. A neighbor sees her and says "What's the matter?" "I was attacked by a robber!"
Question: When did she say that a robber had attacked her?
Answer: She said "a robber attacked me" when she was opening the door to her apartment.
----OR---
Answer: She said that a robber had attacked her when she was opening the door to her apartment.
A good actor could deliver that line with the right pattern of stress and intonation, and bring out that second meaning.