IIRC they have written blog posts in the past saying just as much.
Without losing their stake to slashing penalties, though, the worst kind of attack 66% (not 51% iirc) can do anyways is a censorship or denial of service attack. Which is bad, but at least they can't revert transactions or double-spend like in a PoW model.
If an actor pulled off a 51% attack on Ethereum I'd be surprised if there wasn't an effort to just hard fork them out of their resources.