Since GENESIS_BLOCK_ID = 2680262203532249785L is hardcoded in Genesis.java, I don't see how the attacker could succeed. All he could do is create a Nxt clone.
Yes I see. Thanks. In effect, the 'bootstrap number' I've been talking about, is now 'PART OF THE PROTOCOL'.
Although - if the initial stake holders ever sold their private keys once those accounts were empty, or lost / hacked / QC cracked, then maybe you could cause a little heart ache..