tl;dr: Monero has no scalability limits on the protocol level, it is limited by the infrastructure which is constantly evolving and recently Monero community has been doing stress-tests from which we can see it has no problem running the same and even more transactions daily than Bitcoin but faster and for lower fees.
Have they tested the cost to running a 51% attack on monero? From my understanding it should be pretty easy given the large number of server clusters in the world. One of the biggest hurdles to attack bitcoins network is the cost of hardware. Also a lot of governments don't like monero. Who's to say one day a wealthy enough government somewhere doesn't pay for a server cluster to attack monero for a few days to destroy its credibility?