The attack runs within the rules of the DAO and so does the counterattack. It's still distributed.

What if the attacker made their move before it could be blocked?

The DAO code that the stolen ETH is held in doesn't allow spending for 27 days, by which time the Ethereum developers hope to have 51% of node power on the fork that blocks transactions involving this address.

A system not vulnerable to such simple attacks?

Depends how you define attack, really.