I was just wondering what are the security measures that would be set to prevent abuse? DDos attacks for example?
The provider will able to block (or limit) any network connections outside the publisher's box (we might block it by default to avoid such concerns). Providers may block data persistence as well. They will also be able to work with specific trusted publishers (such as a University). That's where the beauty lies - it's an open and free market. It's all up to participant's decisions and preferences, including the pricing.
As for security on the provider's PC itself, it all runs in a restricted VM and the publisher does not gain elevated access even inside the Docker box, not to mention elevated or non-elevated access to the VM containing the boxes, not to mention access to the OS running the VM.
If a client is looking for say 1000 computers worth of computational power, would the client and each "Seller" have to follow these steps:
Yes, each step is required for any single pair of publisher and provider, and this points to why we need a dedicated coin.
Do the 1000 computers form a cluster acting like one supercomputer?
Yes.
Let us tell something about supercomputers: the fastest one in the world does 33 Petaflops. Like 8000 AMD 280X GPU, which exist maybe in every average western city. They hired 1300 engineers to build this giant computer. And still, not every researcher gets instant access to it..