Peercoin had centralised checkpointing, so not a good indicator of robustness.
I do not know NXT, but PPC style PoS an be exploited.
Nxt has decentralized checkpointing for now, no fork longer than 720 blocks is accepted by the network. They are soon adding a couple others methods.
The real way Nxt protects is by requiring that a SHA256 hash be performed for every block along every possible fork (along with taking into account stake and time since an account last forged). If an attacker wanted to generate a fake fork that was only forged by his own forgers, then he would have to do far more SHA256 hashes within ten minutes or so than the Bitcoin network does within a week in order to calculate how he can build a strong enough fork in order to claim he's built a better fork entirely made out of his forgers... and after all the odds are against him unless he owns ~50% of Nxt.. at which point he can basically 51% attack the network. Though granted he can 51% attack in burst even when he only has say 40% of all Nxt forging power, that's the same as Bitcoin though, even only > 20% of all mining power owned by one pool should scare people.