>all you need is to bring down a high enough percentage of nodes, which will effectively take down the network through capacity constraints

On a fully distributed network, that's pretty hard to do. DDOS works by having tons of nodes to attack with. That won't work very well when your target has as many or more nodes than you do.

Taking down a centralized target is vastly easier.

>Combine this with auto-updating clients and you've got a crashing software bug that brings down the whole network.

Only if I can't role my client back nor turn off auto-update.