Yeah, I don't see any built-in security against a 51% attack specifically in the code.  But the attack still requires collusion between a majority of prime controllers, and a bad actor(s) can be ejected from the network.  All it takes is one prime to call a vote for ejection.  So theoretically, GAW (or the collusion group) would have to own 100% of the prime controllers.  After the ejection, Orion controllers can bid to become prime, thereby also securing against collusion.