That's incorrect because of the assymetry between attackers and normal users. An attacker needs only generate as many transactions as the rest of the network combined, and indeed this isn't that expensive.

A single consumer machine can generate hundreds, if not thousands of transactions per second. A fleet of specialized machines costing less than 7 figures total can do millions, if not hundreds of millions, of transactions per second.

IOTA has a terrible security ratio.