There are also several miscellaneous costs that the article seems to have ignored (Do CMMIW tho), but it assumes that some adversary has the capacity and the ability to produce that many ASICs, to supply that much power, given how the supply is already generally inelastic.
Is it easier to get a large proportion of coins or is it easier to set up your mining rigs and hooking up a few power stations with it? The former is probably far easier given how users are already prone to storing their funds in exchanges and centralization is already not uncommon.
Based on the calculations in the article, the cost required for a PoS attack is 4x the cost of PoW attack. While there may be some miscellaneous costs that the article ignores, it seems unlikely to change the conclusion given the magnitude of the difference in cost (4x).
Putting cost aside, you're right that we also have to consider whether a PoW attacker can acquire the necessary ASICs. If we assume the attacker is a wealthy person who currently has no ASICs, then yes it is very difficult to acquire 51% of the mining power. Just like how you mentioned exchange centralization (as a potential threat to PoS security), so too is miner centralization. It only takes a few mining pools to have enough mining power to attack the network.