Indeed, this is true. I was also assuming you would be buying the ETH from other stakers (if not, you would need $8B in ETH at spot price) and that you as an attacker have the ability to make the network desynchronous (if not, you would actually need 1/2 the total stake rather than 1/3). These are just generous assumptions that give us a lower bound on how much money it would actually take to attack the network.