ASIC mining will make it much, much tougher for an entity to borrow a bunch of computing power to attack bitcoin.
For instance, lets suppose BFL sells just $5 million dollars worth of their "coffee warmers". (a highly conservative number that'd probably leave them bankrupt after they paid for the ASIC development costs) That's about 33 thousand coffee warmers, or 234TH/sec. Suppose the attacker decided to requisition a whole bunch of computers to attack Bitcoin, for instance by asking Amazon or Google "nicely" One 4-way Opteron CPU can do about 115MH/s, so for your 51% attack you'll need about 1 million CPU's. If you're renting from Amazon, that's costing you something like a million dollars an hour, assuming you could even get them to let you rent that much computing power. The capital cost of all that computing power is also in the range of hundreds of millions of dollars, heck, easily a billion dollars with server farm overhead.
Finding a whole bunch of GPU's is actually rather tough, as most GPU farms are for scientific computing and use floating-point optimized GPU's that aren't very good at computing hashes.
A final possibility is borrowing an FPGA farm. We could make the rough assumption that the value of the farm's FPGAs will have the same $/Hash ratio as BFL's currently shipping product. So that's 117TH/sec / 0.8GHash/Single * $600/Single = $87.7 Million dollars worth of FPGAs. Intel might have that kind of FPGA farm available - they're used for chip verification - but again, renting it won't be cheap. Also, it looks like BFL is getting it's FPGAs at pretty cheap prices - a $600 single has $2000 worth of FPGAs in it - so with wholesale discounts we still might need to triple or quadruple that $87 million.
With ASIC mining, the cheapest way to computationally attack Bitcoin is probably by doing a run of your own ASICs, and it's not something you can do quickly. All that effort and money just so you can find out the myriad ways that the devs can stop 51% attacks using techniques possible now that Bitcoin is widely established.
For instance, lets suppose the NSA decides to attack Bitcoin. They could probably round up the hundreds of millions of dollars worth of computing power to make it happen, although it'd be a big hit to their black budget. Chances are within a few hours to days the devs will respond with something like a "coin-age" rule and ask everyone to upgrade. Now blocks get rejected, and nodes blacklisted, if they try to pass blocks into the network that don't meet coin age requirements. Transactions start flowing again, although the price on Mt. Gox has dropped severely, lets say 50%. At the same time the "known-legit" mining pools are also taking steps to protect their investment, by temporarily centralizing a bit, and blocking connections to nodes that aren't on a whitelist; the "most-difficult-block-wins" rule has been temporarily suspended. Note that at this point it's still not possible for anyone to steal coins, and not much more possible to do double spends.
Now, one thing the NSA could do is buy a bunch of coins so their blocks get accepted again. The problem is, now they're basically giving people a way to get out of Bitcoin, and boosting the price on the exchanges, restoring confidence. Exactly what they don't want! If they do nothing, they're still burning at least hundreds of thousands of dollars an hour, while the network figures out ways to mitigate the damage.
Honestly, ordering some assassinations on the guys running major exchanges sounds a lot cheaper...
Why wouldn't someone trying to 51 the network just approach BFL? They'd have ready-to-use chips and it would significantly cheaper for them to produce them than the entity doing it themselves.
As far as I can see, bitcoin security is proportional to market capitalization. The more bitcoins are worth the larger the income for miners will be and, thus, more miners will exist. The marginal cost of ASICs is tiny though. So if some entity were to develop their own ASIC, I'm not sure if it would matter that they'd have to produce 100,000 chips instead of 10,000.
Honestly, ordering some assassinations on the guys running major exchanges sounds a lot cheaper...
And I realize our developers being assassinated is not realistic, but then again I really really really don't want them all on the same plane on any business trips...
We should instate the Coca Cola rule. No two developers can ever travel on the same plane at once!
EDIT: Also, bike helmets are now mandatory for the devs.