He does need to pay fees for the creation and for spending .. but you are right .. he will at the end be able to use his asste to pay the tx fee ..

Btw, how are fees set for assets? Maybe by delegates?

If so delegates can prevent floods by setting fees to availableAmount+1

1 A malicious person (EVIL) registers asset ASSET. Let it be 100000000000000 ASSET (precision 1).
2 That person starts flooding the network with transactions. Each one sending 1 ASSET to random address.

Is this possible?

Who's responsibility is to prevent this ? (Delegates?)
Is there an easy mechanism to block an asset trading?