Earlier quoted context omitted.
Yes. The protection they have against attacks are not ad hoc. They are based on theory and are scalable. One protection strategy (often seen in web-of-trust arthitectures) is to put trust in the authenticity of the current present machine (idk how to better phrase it). This way it doesn't even matter how much of your network is comprised of bots. Your machine will reject them all.
Doesn't that just increase the amount of time the bots have to remain as "sleepers" to embed themselves in the network before turning evil?
This is simplified, for example to be able to trust a peer who is not a friend of yours or your friends, you can add the trust of your friends’ friends in the calculation for a non-friend, while dividing the friends’ friends trust by a number to diminish their effect on the result. E.g. multiply your 2-level friends’ trust levels with 0.9, 3-level with 0.8 and so on.
This way, real peers will live in their isolated bubble network. Bots can’t fabricate your trust in themselves even if a direct friend of yours has a botnet he added as friends to his node, because no one else added those bots as friends other than your malicious friend. That botnet all trusting each other will be another isolated bubble of trust, with no trust-access to the real-peers bubble.
You can use this exact architecture to share and distribute encryption keys to create secure channels with trusted peers. Though you’d have to exchange keys with your friends air-gapped for it to be secure, if all the wires are tapped (which is true for the internet).
The failure mode in this architecture is: If all/most your real-life friends are malicious agents, then your node can live in a botnet trust bubble without you knowing it.