I go into more detail in this [0] comment, but it would be substantially more expensive to pull off an attack if the hashing power was not available to rent from NiceHash. The 'nicehash-able' column is meant to represent how much hashing power is available - if it is > ~300%, an attack would be fairly do-able from just renting hash power.
[0] https://news.ycombinator.com/item?id=17173265