People have many times said to me "Well I can just make 1M nodes on Amazon and take over your network" and these people live in lala land with no consideration at all for the cost of operating 1M nodes in the real world.
I can just open 10000 ports on
one server running the same code, sharing the transaction database and any other overheads between them. This is the essence of the sybil attack.
edit: think about it like this: what *is* a node in your system, a port? A private key? These things are trivially cheap.