The Ropsten testnet uses proof-of-work, and can be cheaply attacked for the reasons you give. It has been attacked on several occasions in the past. This generally makes it unreliable for testing applications on, although sometimes this is a risk worth taking to use a testnet which is as close as possible to the rules of the main network.
To allow testing without worrying about low-cost 51% attacks, alternative testnets have been created which instead use proof-of-authority, using a consortium of trusted parties, instead of proof-of-work. The most commonly-used are Rinkeby and Kovan.
See this question for more information on the different testnets: Comparison of the different TestNets