A 51% attack is a possibility, and might be currently possible with the largest botnets known to exist today, but it would be pushing it. In future it becomes even more difficult.
It is not just about botnets (CPU "mining" is pretty slow); what do you think stops someone from spending their money on enough ASICs to pull off the attack? It is not all that expensive, maybe tens of millions of dollars in chips. Even if it were hundreds of millions of dollars, if Bitcoin were as threatening to the financial system as some people seem to think it is, that would not be a lot to spend on attacking it.
It is also important to recognize that the existence of an obvious polynomial time attack does not in any way rule out the existence of faster attacks, it only establishes an upper bound on the attack effort. The reason proofs of security in modern cryptography involve a reduction to an (assumed) infeasible problem is that it rules out all practical attacks (in fact, all theoretically feasible attacks).
Not all the tools we have for maintaining security are as good as public key encryption or symmetric encryption. In the world of bricks and mortar, $10 million buys you a lot of criminal clout. Is a safe deposit box safe against a determined attacker with that budget? Are all employees immune to million dollar bribes?
The law attempts to redress imbalances by making it difficult to get away with circumventing security to perpetrate financial crimes. The problem is not so much stealing from a bank, but getting away with it after the fact. The same problem applies to bitcoin if you want to execute a 51% attack; double-spending is financial fraud, after all.
Buying up $10 million worth of ASICs is relatively straightforward, but doing so in a way that can't be traced back to you is substantially more difficult. As well as the problem of trying to run that amount of hardware in secret, without a paper-trail, you'll also have problems in trying to convert any profits you make from the scheme back into fiat currency.
If one merely wanted to demonstrate the attack without profitting from it, then one could double-spend a small amount between accounts you own, in the same way that one could demonstrate an attack on a safe by buying one and then drilling into it. But that doesn't change the fact that there's a big difference between circumventing security, and illegally profitting from it without consequences.
