Keep in mind that the attacker is losing money through those fees, though.
I'm not sure this would really count as much of an attack, more of yeah, that's how it's supposed to work.
(Though sure, maybe we shouldn't want it to work that way.)
It reminds me of the analogy of going to a small restaurant and implementing the attack of buying all their food so nobody else can get any.
And the small family owned restaurant keeps raising their prices so long as you can afford it.
Yeah, stinks for other customers, but it's how restaurants work, and the owners are delighted, and eventually you run out of money.
Anyway, yep, and miners can implement that sort of ranking to avoid this situation if they wish. The fees are the mitigation built in.
One issue is that spammers have at least an idea of a sustainable plan: pay this money to spam and make up for it in sales or scams or whatever they're selling in the spam.
It's not as straightforward to recoup the cost of buying that transaction capacity in the blocks.
It would be more of a one time, let's spend this money to screw with Bitcoin for a day! sort of plan, but I can't think of a way to translate that sustainably into a cycle that's funded.