Hi @Twan . Thanks for your question and interest in this post.
To follow-up on your points:
- Yes, the amount of money that can be lent is directly proportional to the amount of money currently available in liquidity pools. Whether that is enough or not to cover governance control in a target protocol, depends on the target protocol and how much their governance tokens are valued and the amount minted. For Maker, it would have been a matter of time if they had not mitigated governance control (see discussion at: Research Summary: The decentralized financial crisis)
- Apart for bugs in the lending platform, there is no default risk, as everything happens in a single transaction. If the loan is not paid back in the same transaction, the latter reverts entirely. The economic incentives for giving flash-loans are in the form of collected loan fees, which are in turn shared amongst liquidity providers and the platform itself.
Let me know my explanation helps :)