Spamming enough to seriously impact the cost of transactions can be done for far less than getting most of the mining power. Probably less than a million, depending on how long you're willing to wait to accumulate coindays and other factors.
If you do it well enough such that there's no simple rule to distinguish them (that could be written in an emergency, as has been suggested), then it seems like it would be a big deal. Who's still using bitcoin when the fees are >$10 per tx?
(I think the eventual solution will involve larger blocksize + proper pruning, and shifting costs to the cost-generators by, for instance, requiring the sender to provide the full input instead of storing it in the utxo database, but so far the existing proposals aren't really complete and well-reviewed enough to be used.)
Edit: oh, and off-chain stuff like lightning.
The other interesting thing is that the price went up even though the network was literally unusable. The spam demonstrated that the price of Bitcoin is literally detached from any form of utility whatsoever. The exchange price appears to be dictated by day traders only.
Why should the price track current utility as opposed to expected? If the market as a whole doesn't expect this spam to have a long-term effect, it won't affect the price.
Being found out as the source of an attack is the biggest deterrent. Without the deterrent the temptation for a vested interest must be a magnitude higher.
It doesn't seem like much of a deterrent. Suppose we knew for a fact that the attacker was John Smith in Chicago. How would that deter them?