I think you make a great point. There have been some suggested attack surfaces with free transactions, but with the holding costs involved in powering up, you could still be right. For now, at minimum, there is baseline RC based on having an account. This RC will regenerate and allow any account to powerup given enough time passing (approximately a few hours).