A quick example, DDoS the top 3 pools and you've disabled a large percentage of the network, which makes the 51% attack require less hardware to pull off. Another version is take control of the top pool, while DDoSing the next two smaller pools. Here you've managed to get 51% without any hardware investment what-so-ever.
I beg to differ. While you may be able to DDOS large pools to bring mining power offline,
the difficulty remains the same for at least two more weeks. It is infeasible to perform such an attack for so long; and botnet operators know that a 2 week (or longer) DDOS spree would get large portions of their nets shut down.
Furthermore, as evidenced by previous experiences with DDOS (to Deepbit, Slush, BTC Guild, and other large pools), the mining power is not magically reduced by the offline-pool's total hashrate - many miners are configured to switch to solo-mode if they cannot reach any configured pools. This preserves the security of the network, even if it does reduce its efficiency for a while.
Finally, a 51% attack really would not achieve anything more then double-spends being possible by an attacker. While this is a bad thing, it isn't a total breach of security,
a la side channel attack or similar.
I do agree that p2pool is eventually going to become more important - however in its current form
it cannot scale well to support a huge network of miners. The more ideal situation will be to have p2pool being partially centralized and partially decentralized - this would spread the load and allow for the easier configuration that is currently possible with a regular pool.
Another option is mining over Tor to a hidden service - Slush is the only one that I know of that offers this right now, and it is something that might become necessary if some regulation is conferred upon Bitcoin, rendering mining illegal or some such.