Yes, that seems a possible attack. You can store stuff and pass the regular audits using "Proof-Of-Storage", yet refuse to upload bits when finally asked.
Hard to protect systems from irrational attacks like that (we know from building a similar system). They are quite transparant about their "unsolved-problems": https://github.com/filecoin-project/specs/issues/63
AFAIK nodes get paid for serving data and they can set the price to be higher than their bandwidth costs, so refusing to serve data is refusing to make money.
