The scenario of someone outright buying new miners for hashpower is unlikely. Who would sell and buy that many miners. That can happen if their is some,; to use that popular world, collusion between bitmain and Governments. Such a collusion is always a possibility but I don't think this can be done without someone noticing. And if the word gets out, then a PoW change is the easiest way to render all those ASICs redundant.

The other two scenarios are:

1. Pools coming together to attack
2. Bitmain flipping the kill switch.

Now the first one is unlikely because such a step will only hurt their investments by denting bitcoin's reputation. Bitmain flipping the kill switch and outright attacking the network as a last resort to prop up BCash is the most likely scenario.
This is scary as Roger, CSW and Bitmain have continued their tirade and marketing against bitcoin in mission mode. It is strange that there isn't more discussion on this in the forum. Maybe it is time to take this to the Ivory Tower.