Yes account age is jut one parameter. A good REDPOS implementation would logically depend on a good REP system development as REP would be a key aspect of such a protocol.

What Justin Sun did to STEEM blockchain is a complex type of Sybil attack, using SP to vote from socially unauthorized sources (both the Steemit Inc. stake and the exchanges stakes were not supoused to vote). It's both democracy and ownership fraud (but ownership restrictions agreed by the human community were not coded).

If you buy an asset that comes with certain restrictions, you get a discount. If you then ignore those restrictions (because there is no code that can actually avoid you to ignore them), you create value in a fraudulent manner.

The aim of a REDPOS protocol should be that the witness designation process be less democratic so to avoid sophisticated sybil attacks.