and SPV nodes would have to follow them and trust that they are correct, even though they may not be.
But there are no SPV "nodes" in this scenario. There are SPV wallets connected to a full node (and lets assume it is one they trust or have some control over for now), there are mining full nodes, and there wallets with nodes running on same machine.
..spreading around bad blocks and invalid transactions
But any full node (mining, wallet node) then would reject it.
Anyway I don't really doubt you are correct. This has always been my assumption and part of why I run a full network node myself. However I see things like
https://twitter.com/adam3us/status/683678942398644224 and it makes me wonder (note: vps nodes worth zero), whether my assumption is flawed.
Maybe you could point me to some more info on how the checkpoints and forking issues you mentioned. Have there been any simulations done for this, or detailed write-ups on the exploits? On the one hand, yes it seems fairly obvious that full nodes improve security. On the other hand if everyone with a wallet is already directly connected to a full node, then it is less clear how the exploits progress.
More nodes are also a lot harder to DDoS
This part makes sense. As well as your comments about the government shutdown.
Maybe a more technical way of phrasing the question is: what is the minimum number of network nodes needed to protect against current known attacks?