I'll leave conclusion to what you've said, as an exercise for reader.
So when it comes to such kind of "attack" is the situation in NXT and NEM that different? (especially since you can't cancel "lease") (*)
(*) rhetorical question.
To exercising readers:
Please, note that Nxt leasing can be cancelled almost instantly by transferring all the coins to another account. Also, even if Nxt leasing had a fatal security breach this still wouldn't counter my argument about NEM.