1. as has been pointed out many times, the attack is not expensive,
Tens of millions of dollars for hardware, and millions more for manpower is expensive for most groups in the world.
the oft-repeated statistic about bitcoin being the largest supercomputer or exceeding 500 others is silly and almost intentionally misleading. many 3d-intensive games are much larger 'supercomputers' on the same metric, as probably is the global dns system or smtp.
What do you mean many 3d-games have more hashing power than the top 500 supercomputers? You mean 3d MMOG server farms? Do you have any statistics on this? I'd like to learn more.
as to reserve hashing power, it's unlikely that there's a significant amount of it that could easily be deployed.
What's unlikely about there being 10s of millions of computers that can contribute to the network by simply visiting a web-based miner using WebCL?
and it works both ways: what stops an anti-bitcoin lobbying group (say, one that opposes some illegal site that uses bitcoin) from distributing an attack?
I think that's highly unlikely but it's difficult to provide any solid evidence for why. I think that an attack would be far more likely to come from a closed organization than a grassroots movement, especially a web-savvy grassroots movement who are the most likely group of people to share in bitcoin's ideals of allowing p2p monetary transfers without the need of going through large banking intermediaries.
1. as has been pointed out many times, the attack is not expensive, nor does the fact that mining is profitable mean that a strategic attack on a valuable block chain won't be far more profitable.
A strategic attack would not be profitable because it would benefit not only the attacker, but the attacker and all competing currencies. If an attack is done by someone with a stake in a bitcoin variant, it would undermine the very concept and be unprofitable.
this neglect of the strategic value of an attack is the only well-known significant mistake in satoshi's original paper, one that the analyst going by the name 'computerscientist' in various online forums has pointed out in detail.
A strategic attack could certainly be valuable to someone for ideological/non-monetary reasons, I just don't see any reason to think it could be profitable.
2. the attack is not easy to detect. please outline a mechanism for detection in the general case if you think you have one. the general problem is that the only response to a proof-of-work attack is greater work; it's very difficult in practice to distinguish 'good' work from 'bad' work.
People start complaining about bitcoins they received suddenly being unconfirmed.