when we get there we've won.
On the contrary, to the extent that you're there you get hammered by the botnets. This isn't something you can easily fix when you're at that later stage; hard forks are problematic and threaten trust.
You will *NEVER* stop a determined thief, you can only slow them down. That's what we're aiming for...
If the proof of work is violable then it will be exploited to the degree that it is possible and profitable to do so. You'll need a better indicator of human status than 8GB of flash to preclude this kind of activity. If all this seems horribly critical, I apologise. I'd like it if you could convince me otherwise.