As you can see, it's a bad situation for an attacker. They cannot simultaneously have "whale" levels of voting power and also guarantee they'll be assigned the votes they want to control. But it gets even worse for an attacker. Even if they hold massive voting power in their account, and get lucky enough to be randomly assigned the vote they want, they can't set chain parameters. Votes are only for incremental changes from the existing parameter levels. And on top of that, the effects of votes drop off over time. That is to say, a vote outcome today will not have an effect on the chain parameters after 60 days. So they would have to have absurd luck, again and again, to dominate the chain.