NEO will have transaction fees. For NEO immutability than availability from what I understand which implies all past information is safe. In a worst case scenario at this point in time when there are no fees, the network freezes. NEO can then locate the source of the issue, quarantine it (and possibly even fine the source) and then reboot the network. All I see is that in a worst case scenario the network is temporary out of operation. Nothing truly shocking as not much of real relevance is happening yet. In the future the NEO network might possibly also have a much easier time identifying the source of such activities and I believe in the future NEO even has a level of reversibility in select instances. Personally I am not concerned. It might even be a good thing as it implies a competitor takes NEO seriously enough to attempt to derail it temporarily. I'd rather have a few of the issues you describe than a DAO hack. Keep in mind though that the Chinese government throws ICO scammers in jail for life, but attempts to cause harm to legitimate blockchains likely will meet a similar fate if the Chinese government can get their hands on the perpetrators. Regulation of blockchains also means the legitimate ones are protected by law up to certain extents.