> PoS is resistant to state attacks because it would require buying up tokens on an impossible scale

You don't need to buy the tokens. You make laws which the stakers have to follow, otherwise you seize their tokens for breaking the law. You can also use electronic warfare to steal the tokens of stakers outside your juridiction. If you are doing this as a big country such as USA/China, then other stakers might be tempted not to fork because a compromised system that works with those countries might still be more valuable than an uncompromised system that has not access to a large part of the world economy.