Yes, like any P2P network Bitcoin cannot work if a sufficiently large number of miners decide to attack it.

1. They won't be attacking Bitcoin, they will attack merchants who accept payments with 0 confirmations. This attack has nothing to do with Bitcoin consensus mechanism (as Bitcoin protocol doesn't provide a consensus over mempool contents), thus it is not an attack on Bitcoin.

2. In the example I used, having 10% of hashpower is enough to offer 10% success rate. Would you mind having 1 out of 10 hamburgers for free? If a system can be attacked by a tiny fraction, it is a shitty system.