This isn't true. One party being in control of most of the validation can't do much beyond performing a DoS attack, but that's not going to make them any money.

This isn't true. One party being in control of most of the validation can't do much beyond performing a DoS attack, but that's not going to make them any money. So what you actually need is a party who controls most of the validation and is willing to go against their own economic self interests in order to cause damage, that's a much bigger ask.