Because of cycle rotation and a random but deterministic lottery to accept nodes into the network, an attacker would have to take over 51% of all nodes in the list waiting to join a network and the usual 51% of nodes that would be in a network. Nodes waiting to join a network are not part of the consensus. To ever have a majority of nodes in the network, an attacker would also need to have > 51% of nodes waiting to join for a sustained period. Suppose you had less than 51% of joining nodes. In that case, statistics will be against the attacker. It would be a majority of honest nodes accepted into the network over time. If there are 10k nodes in the network but 100k waiting to join, the attacker would need to maintain >50k nodes for an extended time until eventually >5k of them are rotated into the network as the network slowly cycles in and out its entire set of nodes.