Exactly my point proof of work can not be Sybil attacked, and under Bitcoin Unlimited the blocksize limit is determined by the economic majority through proof of work. Not the nodes like you claim, therefore BU is not vulnerable to such an attack vector.
BU nodes do not accept the longest chain if it disagrees with their idea of validity (e.g. block size), until that longest chain is a sufficient number of blocks ahead. This creates forks that will persist for up to an hour or even longer, and can be used for attacks. Many merchant systems currently use 1-3 confirms on Bitcoin and will either have to change that to a higher number or be easily attacked.
This would be problematic if a merchant kept her excessive block size limit
constantly below the actual block size that is being accepted by the majority on
the network.
However in real life we can expect the consensual block size limit to update
itself infrequently, thus allowing ample time for the users to adjust.
I think many (well-intentioned) BU critics have hard time of letting go
from concentrating exclusively on how a particular implementation
works, to include the social-economical activity of the players involved:
users, merchants, full node operators, miners, devs.
That's exactly my point. You can't rely on the non-Sybil properties of a proof-of-work longest chain. You have to make other complex arguments about socio-econmical activity and once you do that it is easy for Sybil attacks and various other forms of social engineering attacks to sneak back in.
BU may be a perfectly good approach for cryptocurrency, taken broadly, but it doesn't work the same way as Bitcoin and can't legitimately claim to, nor rely on Bitcoin's established security model or properties.