This leaves out any miners turned of because of power costs, and non-ASIC compute. I have no idea how big those are. My completely unfounded guess would be that all of AWS available CPU compute woudn't be enough compute for a 51% attack.
I suppose they meant, that many parties do have that much potential compute but they use it for other things. But they could in theory switch to computing bitcoin hashes and control 51%, and in turn some other party can do the same etc... Obviously you're right that eventually one party can own 51%, but that doesn't mean only one party can successfully perform 51% attack, since % of hashing power can change by time.
well yeah, CPUs are many orders of magnitude slower than ASICs