What we see in practice is that the dominant exchange for NXT (bter before, now poloniex) only have around 5% of the coins in their custody. They need 10 times more to do a 51% attack which is very unlikely to happen.
No, you only need 51% of the coins that are actively staking, not 51% of the total supply. This is why exchange hacks have been a huge deal with PoS coins even when they don't approach 50% of the total supply.
In the case of Nxt (and most coins today that aren't really used much) the bulk of the supply is likely held relatively few people, each having large amounts, which motivates staking (and also makes them feel personally invested in the coin for a significant portion of their net worth, which means they will actively defend against attacks, while someone with pocket change would not particularly give a shit). If I own 300 EUR worth of coin out of a supply worth billions or even trillions of EUR, I'm just not ever going to bother staking it.
Some coins try to get around this with delegated staking but the problem there is further centralization to one or a few stake pools.
CLAM does at least have an incentive to actively stake since it uses proof-of-working-stake (no coin-age component). Still many small holders of CLAM don't bother to stake in practice.
Talk is cheap.
Who will attack NXT? Please use these exploits to attack. Attacker gets to win money.
Win money attack NXT with actions not words.
It may be that Nxt is in fact 100% secure because >50% of the stake has always been held by a few people such as Marc De Mesel who will defend it against attacks. That doesn't make it decentralized nor does it make the
method secure just because Nxt in particular might be.